Search papers, labs, and topics across Lattice.
The paper introduces SPILLage, a framework to formalize and characterize Natural Agentic Oversharing, where web agents unintentionally disclose task-irrelevant user information through their actions on the web. The framework categorizes oversharing by channel (content vs. behavior) and directness (explicit vs. implicit). Experiments across e-commerce tasks reveal pervasive oversharing, with behavioral oversharing significantly exceeding content oversharing, and demonstrate that mitigating task-irrelevant information improves task success.
LLM-powered web agents leak 5x more user data through their behavior (clicks, scrolls) than through explicit text, a blind spot current privacy research overlooks.
LLM-powered agents are beginning to automate user's tasks across the open web, often with access to user resources such as emails and calendars. Unlike standard LLMs answering questions in a controlled ChatBot setting, web agents act"in the wild", interacting with third parties and leaving behind an action trace. Therefore, we ask the question: how do web agents handle user resources when accomplishing tasks on their behalf across live websites? In this paper, we formalize Natural Agentic Oversharing -- the unintentional disclosure of task-irrelevant user information through an agent trace of actions on the web. We introduce SPILLage, a framework that characterizes oversharing along two dimensions: channel (content vs. behavior) and directness (explicit vs. implicit). This taxonomy reveals a critical blind spot: while prior work focuses on text leakage, web agents also overshare behaviorally through clicks, scrolls, and navigation patterns that can be monitored. We benchmark 180 tasks on live e-commerce sites with ground-truth annotations separating task-relevant from task-irrelevant attributes. Across 1,080 runs spanning two agentic frameworks and three backbone LLMs, we demonstrate that oversharing is pervasive with behavioral oversharing dominates content oversharing by 5x. This effect persists -- and can even worsen -- under prompt-level mitigation. However, removing task-irrelevant information before execution improves task success by up to 17.9%, demonstrating that reducing oversharing improves task success. Our findings underscore that protecting privacy in web agents is a fundamental challenge, requiring a broader view of"output"that accounts for what agents do on the web, not just what they type. Our datasets and code are available at https://github.com/jrohsc/SPILLage.
