For their analysis, the researchers developed AgentCIBench, a benchmark of executable scenarios that are scored automatically and reproducibly. The team used it to test 15 current agent systems in 117 everyday scenarios, such as status updates to managers or sharing available meeting times. Twelve of the 15 systems disclosed private information in more than half of the scenarios, for example medical appointments in a work-related message. Across all systems, the average leakage rate, meaning the share of scenarios with inappropriate disclosure, was 67.9 percent. The results also show that a high task completion rate reveals little about how carefully a system handles private data. "These systems are not acting maliciously; they are simply inattentive. They share what is closest at hand rather than what is appropriate. As long as we only measure whether a task was completed, this behavior remains invisible," says Prof. Dr. Iryna Gurevych, an ATHENE researcher at TU Darmstadt. If developers add targeted data-selection instructions to an agent's system prompt, its leakage rate drops by 33 to 36 percentage points in the tests, while task completion actually improves.

The researchers will present their findings in late October at the prestigious Conference on Empirical Methods in Natural Language Processing (EMNLP 2026). The accompanying paper, “Capable but Careless: Do Computer-Use Agents Follow Contextual Integrity?” was conducted as part of the ATHENE project, Security in Large Language Models (SecLLM) in the research area SenPAI. The research paper is publicly available at https://arxiv.org/pdf/2606.23189.

The defensive measures proposed in the research paper are already being incorporated into follow-up work on the topic of agents; see, for example, the paper “Nothing to See Here”: Unintended Disclosure through Revision Traces of LLM Deliverables. In addition, the study was mentioned in the “AI Weekly” report: https://aiweekly.co/alerts/agent-ci-bench-finds-most-frontier-agents-leak-private-data.

show all news