arXiv:2606. 12666v1 Announce Type: cross Abstract: Screenshot-based mobile GUI agents can operate ordinary smartphone apps through the same visual interface as a human user, but this capability also turns every screen observation into a privacy boundary.
BodhiPromptShield is a policy‑aware mediation layer for LLM agent pipelines that detects sensitive text spans before they propagate, replacing them with typed placeholders, semantic abstractions, or secure tokens and restoring them only at authorized execution boundaries. In evaluations on AI4Privacy, PrivacyLens, and AgentDojo datasets, the system reduces identifier exposure to 7.4% and 1.8% respectively, and limits exact identifier leakage in final actions to 2.1–3.1%. While mediation preserves factual content according to automated metrics, human annotations show a significant drop in inferability from 100% to 24–53%, indicating the need for human validation of semantic‑leakage measures.
MCPHunt is a benchmark framework that isolates non‑adversarial credential propagation across multi‑server MCP trust boundaries. It uses canary‑based taint tracking, a controlled coverage design with risky, benign, and hard‑negative conditions, and completion‑requires‑secret stratification to separate faithful from policy‑violating propagation. Across 3,615 traces from 5 models, policy‑violating propagation rates range from 11.5 % to 41.3 %, with mitigation via prompting reducing rates to 0.3 % while retaining 80.5 % utility.
arXiv:2607. 24625v1 Announce Type: cross Abstract: Autonomous LLM agents processing mixed-confidentiality data face severe security risks from prompt injection attacks and reasoning errors.
arXiv:2606. 00152v1 Announce Type: cross Abstract: LLM-based agents are rapidly advancing, autonomously invoking external tools to complete multi-step tasks for users.
The paper introduces Task-Graph Contextual Integrity (TG‑CI), a formalism that extends traditional Contextual Integrity to multi‑agent systems by modeling workflows as Multi‑Agent Task Graphs (MATGs). TG‑CI evaluates privacy not just at individual disclosures but across the entire downstream propagation, offering two enforcement policies—Full‑Scope and Auto‑Region—that balance privacy protection with task performance. A new benchmark, MAPLE‑Bench, demonstrates that TG‑CI can cut unauthorized disclosures by up to 94% while preserving over 94% of task accuracy compared to existing local‑history CI methods.
arXiv:2609.14003v1 Announce Type: cross Abstract: Personal AI agents built on large language models (LLMs) are increasingly given access to a user's private data and communications in order to provid...
arXiv:2609.00015v1 Announce Type: new Abstract: AI agents powered by large language models are evolving from isolated assistants into heterogeneous systems in which multiple agents, planners, control...
PrivacyFlow introduces a new benchmark, PrivacyBench, and a defense system that separates privacy planning from task execution in autonomous LLM agents. The system traces data provenance, models recipient knowledge, and simulates inference attacks to weigh disclosure risk against task utility, allowing it to minimize or block data sharing. Experiments show that PrivacyFlow reduces privacy failures and increases completed task sequences by 22–55 percentage points, while revealing a tradeoff between privacy, utility, and user autonomy.
Autonomous LLM agents executing multi-step workflows over personal data often misalign with user privacy expectations and leak sensitive, out-of-context information. Although Contextual Integrity (CI)...
arXiv:2606. 28061v1 Announce Type: cross Abstract: Large language models (LLMs) have increasingly moved from standalone text generation systems to agents that invoke external tools, access environments, and execute multi-step tasks.
The paper exposes a vulnerability in AI toolchains where signed Model Context Protocol (MCP) tools can hide malicious code that leaks data, even when protected by state‑of‑the‑art runtime defenses. It introduces germline execution, which runs each tool invocation in an isolated, data‑free copy, limiting information disclosure to only what is authorized for the destination. Experiments on 153 attack runs show that germline execution prevents unauthorized disclosure in all cases, outperforming baseline defenses and ablations, while maintaining efficient performance (10‑49 ms per invocation).