Search papers, labs, and topics across Lattice.
This paper evaluates the data leakage risks associated with tool-using LLM agents in non-adversarial scenarios, highlighting that sensitive information can be inadvertently exposed even during benign interactions. The study, conducted by the Singapore AI Safety Institute and the Korea AI Safety Institute, assessed three agents across 12 realistic tasks, revealing that none achieved complete safety or correctness in data handling. Key findings indicate that successful task execution often correlated with failures in data management, emphasizing the need to separately evaluate capability and data-handling safety in AI agents.
Operational data leakage poses a significant safety risk for AI agents, even in non-adversarial contexts, with none of the tested models achieving full compliance in realistic tasks.
AI agents are increasingly being adopted in enterprise and personal settings with access to emails, databases, documents, and other tools where they can read, update, and disseminate sensitive information. Much of prior research on data leakage risks in agents has focused on adversarial data exfiltration through prompt injections and jailbreaks. However, sensitive information may also be exposed during non-adversarial use, creating leakage risks even when users issue benign requests. We report a joint evaluation by the Singapore AI Safety Institute and the Korea AI Safety Institute examining agent data leakage in 12 realistic, non-adversarial tasks spanning customer support, DevOps, web automation, and enterprise and personal productivity. The evaluation covers five risk types: lack of data awareness, audience awareness, policy compliance, data minimization, and access-boundary awareness. Both institutes tested a common set of scenarios mirroring real-world deployments using independent testing environments and task-specific LLM-judge rubrics. Across the three tested agents, none achieved fully correct and fully safe execution across all scenarios. Successful task completion often coincided with data-handling failures such as accessing unnecessary information or disclosing information to inappropriate recipients, indicating that capability and data-handling safety should be evaluated separately. Qualitative review also revealed claim-action mismatches, simulation-aware behavior, user-simulator role reversal, and interpretation gaps in automated judging. Overall, the results indicate that operational data leakage is a first-order agent-safety concern distinct from adversarial exfiltration and provide a methodology for future evaluations of agent data-handling safety.
