AgentCIScope turns privacy cases into 936 executable agent tasks across 11 application environments and finds single-run leakage rates from 32.5% to 94.4% across 12 agents, so strong task completion does not imply contextual integrity.
The authors define and formalize behavioural side-channel leakage in browser-use agents, introduce the AgentTell benchmark of 20 scenarios and 100 tasks, and evaluate six backbones across 9,760 sessions, finding that agents carrying a secret reveal it through task-directed action choices in 61.1% of sessions despite an explicit privacy instruction, that agents still leak in 56.7% of sessions where their own memory states the secret must not be shared, and that in 34.5% of leaking sessions their final responses falsely assure users that no information was disclosed.
You’re all caught up