A clean answer can arrive after an AI agent has opened more of your life than the task required.
What changed
A revised preprint from Zhang and colleagues introduces PrivacyPeek, a benchmark that checks what tool-using agents request and receive while completing a task. Its 1,182 synthetic, executable cases cover seven acquisition behaviors across 16 application domains. Each case includes a human-reviewed minimum scope: the files, fields, formats, and time window needed to finish the job.
That comparison found some data outside the minimum in all ten tested agents. Reported Content Exposure Rates ranged from 6.77% to 51.95%, depending on the agent and test conditions.
But the gap did not disappear as task completion improved. Higher completion and higher exposure appeared together across the ten-agent panel. Different models and policies were involved, so this is a descriptive relationship rather than evidence that capability caused the extra access.
Privacy instructions in the system prompt reduced exposure in selected runs. Some measured exposure remained, which moves attention toward the tools and data boundaries around the model.
Why it matters
So an output review asks what the agent said or sent, then PrivacyPeek moves the check upstream to the tool trace. Which appointment records did it fetch? Which database fields came back? Which files did it open, and what stayed in the task context?
That shift exposes something a clean response can hide. The agent may return the requested answer while unrelated personal data has already crossed into its working context. A later mistake or attack then has more material to work with.
Acquisition does not prove that anyone suffered a real breach or harm. The study used synthetic records and purpose-built tool environments. It is a revised preprint, its results were not independently reproduced for this card, and ten model versions cannot represent every deployment. The authors' follow-up probe is a controlled stress test rather than an estimate of attack frequency.
Still, the benchmark turns an invisible privacy question into a checkable one: compare what the task needed with what the agent actually read.
Watch next
Real application traces would show whether the pattern survives production data and tool design. Tests of least-privilege schemas could reveal how much exposure falls when an agent can request only the fields a task needs. Context isolation needs its own measurement too, because data acquired for one step should not quietly remain available to unrelated later work.
Operators can run a bounded audit now. Pick one workflow. Write down its minimum data scope, capture every tool call and returned field, then compare the trace with that scope. A clean final answer should not end the privacy review before the read itself has been checked.