PrivacyFlow introduces a new benchmark, PrivacyBench, and a defense system that separates privacy planning from task execution in autonomous LLM agents. The system traces data provenance, models recipient knowledge, and simulates inference attacks to weigh disclosure risk against task utility, allowing it to minimize or block data sharing. Experiments show that PrivacyFlow reduces privacy failures and increases completed task sequences by 22–55 percentage points, while revealing a tradeoff between privacy, utility, and user autonomy.
By Robin Staab, Tom Wollschl\"ager, Vahab Mirrokni, Reza Shokri
arXiv:2606. 07150v1 Announce Type: cross Abstract: Agent-interoperability protocols such as A2A and MCP standardize what agents say to one another, but assume address-based transport over HTTP(S).
By Bijaya Dangol
Autonomous LLM agents executing multi-step workflows over personal data often misalign with user privacy expectations and leak sensitive, out-of-context information. Although Contextual Integrity (CI)...
arXiv:2607. 24625v1 Announce Type: cross Abstract: Autonomous LLM agents processing mixed-confidentiality data face severe security risks from prompt injection attacks and reasoning errors.
By Arseny Kravchenko, Vadim Liventsev, Innokentii Konstantinov, Ildar Iskhakov, Matvey Kukuy
arXiv:2606. 00152v1 Announce Type: cross Abstract: LLM-based agents are rapidly advancing, autonomously invoking external tools to complete multi-step tasks for users.
By Mingxuan Zhang, Jiahui Han, Dadi Guo, Songze Li, Guanchu Wang, Na Zou, Dongrui Liu, Xia Hu
arXiv:2606. 26627v1 Announce Type: cross Abstract: Large language model agents increasingly query databases, search document collections, call external APIs, remember past interactions, and act on a user's behalf.
By Nada Lahjouji, Ashwin Gerard Colaco
arXiv:2608. 10509v1 Announce Type: new Abstract: Shared memory helps language-model agents reuse information across long workflows, yet relevant evidence may not be admissible for a particular agent or action.
By Yiqi Wang, Zihao Yan, Jiaqi Zhang, Zhangkai Wu, Mingkai Zheng, Zequn Sun, Yanming Zhu, Taotao Cai
arXiv:2609.14003v1 Announce Type: cross
Abstract: Personal AI agents built on large language models (LLMs) are increasingly given access to a user's private data and communications in order to provid...
By Minsun Shim, Ramisha Raida Karim, Ruthwik Jakkula, Kaiwen Zhou, Xin Liu, Xin Eric Wang, Zhou Li
MCPHunt is a benchmark framework that isolates non‑adversarial credential propagation across multi‑server MCP trust boundaries. It uses canary‑based taint tracking, a controlled coverage design with risky, benign, and hard‑negative conditions, and completion‑requires‑secret stratification to separate faithful from policy‑violating propagation. Across 3,615 traces from 5 models, policy‑violating propagation rates range from 11.5 % to 41.3 %, with mitigation via prompting reducing rates to 0.3 % while retaining 80.5 % utility.
By Haonan Li, Tianjun Sun, Yongqing Wang, Qisheng Zhang
The paper introduces authorization‑paired evaluation and the FlowReview framework to address safety issues in multi‑agent systems where shared evidence can enable prohibited uses. By jointly enforcing blocking of prohibited actions and completion of authorized ones, FlowReview connects object resolution, permission ranking, and deterministic enforcement. Experiments show that reviewing combined artifacts can eliminate denied‑commit rates without sacrificing authorized supply, highlighting the need to link object identity and permission to execution for safe collaboration.
By Yunbei Zhang, Saiyue Lyu, Janet Wang, Yingqiang Ge, Jiang Guo, Jihun Hamm, Chandan K Reddy
arXiv:2610.16039v1 Announce Type: cross
Abstract: Multi-agent LLM systems (MALS) introduce a privacy-leakage problem that conventional sensitivity-based defenses miss, since information disclosed to...
By Sunday Oyinlola Ogundoyin, Muhammad Ikram
Multi-agent large language model (LLM) systems can expose protected state through internal messages, tool arguments, logs, and persistent memory even when their public outputs appear innocuous. Existing privacy prompts, redaction methods, and source-level access controls restrict surface content or data access, but do not specify what a legitimately informed agent should disclose or how that disclosure may be reused downstream.