From Conventional Web Privacy to Agentic Disclosure: How Tool Schemas May Invite LLM Oversharing

2026-06-25 · Source: Paper Index on ACL Anthology · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, quick

Summary

A new privacy risk, "agentic disclosure," emerges in LLM agentic systems where agents generate API requests to external services at runtime, potentially oversharing user data. Unlike conventional web settings, disclosure is no longer limited to direct user input but can be generated by the agent, making context-sensitive boundaries harder to preserve. This position paper argues that the runtime tool call is the critical unit for privacy analysis. It diagnoses interface conditions that increase oversharing plausibility, specifically focusing on schemas exposing generic, weakly constrained free-text fields. A case study of 2,344 tool specifications from the OpenAI GPT ecosystem revealed that 36.9% contain at least one such channel. This creates conditions for within-context over-disclosure, cross-context leakage, and contextual flattening, prompting a research agenda for argument-level analysis of data sent to third-party services.

Key takeaway

For AI Engineers developing LLM agents that interact with external services, you must scrutinize tool schemas to prevent unintended data disclosure. Weakly constrained free-text fields in these schemas can lead to agent oversharing, within-context over-disclosure, and cross-context leakage. Proactively audit your agent's tool specifications for such channels and implement stricter argument-level controls. This shifts privacy analysis from just agent outputs to the specific data your agents send to third-party APIs.

Key insights

LLM agent tool schemas with weakly constrained free-text fields create new privacy risks through runtime oversharing.

Principles

• Runtime tool calls are key for privacy analysis.
• Generic free-text fields invite agent oversharing.
• Disclosure boundaries are harder to preserve in agentic systems.

Method

Analyze tool schemas for generic, weakly constrained free-text fields to identify potential agent oversharing channels, moving beyond output-only evaluation.

In practice

• Audit tool schemas for free-text fields.
• Constrain agent input to external services.
• Implement argument-level data analysis.

Topics

• LLM Agents
• Tool Use
• Data Privacy
• API Security
• Information Leakage
• Schema Design

Best for: AI Architect, Research Scientist, CTO, AI Scientist, AI Engineer, AI Security Engineer

Related on AIssential

• Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents — LLM agents' extensive data interaction creates complex privacy risks, requiring a data-centric governance approach.
• Constraint Tax in Open-Weight LLMs: An Empirical Study of Tool Calling Suppression Under Structured Output Constraints — Joint JSON Schema and Tool Calling constraints suppress tool invocation in open-weight LLMs due to token mask conflicts.
• PrivacyPeek: Auditing What LLM-Based Agents Acquire, Not Just What They Say — LLM agents often over-acquire sensitive data during tool use, creating a significant, overlooked privacy vulnerability.
• A new native IDE approach to prevent code leakage to LLMs: Obfuscating ASTs before the API call (Verantyx) — Obfuscating code with Kanji-infused structural semantics allows LLMs to reason without exposing proprietary data.
• When Lower Privileges Suffice: Investigating Over-Privileged Tool Selection in LLM Agents — LLM agents often select over-privileged tools, a risk mitigated by privilege-aware post-training.
• Harnessing Generalist Agents for Contextualized Time Series — TimeClaw's agentic harness framework enables LLMs to perform robust, contextualized time series reasoning by providing native temporal runtime support.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Paper Index on ACL Anthology.