--- title: "From Conventional Web Privacy to Agentic Disclosure: How Tool" description: "They describe two failure modes: within-context over-disclosure , where a service receives more than the current task requires… 1 reference." authors: ["Shahriar Shayesteh", "Shomir Wilson"] year: 2026 venue: "Proceedings of the Seventh Workshop on Privacy in Natural Language Processing" source: "https://aclanthology.org/2026.privatenlp-main.1/" doi: "10.18653/v1/2026.privatenlp-main.1" licence: "CC BY 4.0 (ACL Anthology)" licence_url: "https://creativecommons.org/licenses/by/4.0/" summary_licence: "Elamur Cosmic License" canonical: "https://research.elamur.ai/free/en/papers/shayesteh-2026-conventional-web-privacy-agentic-disclosure/" --- [Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/shayesteh-2026-conventional-web-privacy-agentic-disclosure/) [home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/13/) / From Conventional Web Privacy to Agentic Disclosure: How Tool Schemas May Invite LLM Oversharing # From Conventional Web Privacy to Agentic Disclosure: How Tool Schemas May Invite LLM Oversharing **Authors:** Shahriar Shayesteh and [Shomir Wilson](https://md.research.elamur.ai/free/en/authors/shomir-wilson/) · **Year:** 2026 · **Venue:** [Proceedings of the Seventh Workshop on Privacy in Natural Language Processing](https://md.research.elamur.ai/free/en/venues/privatenlp/) ([Workshop on Privacy in Natural Language Processing 2026](https://md.research.elamur.ai/free/en/venues/privatenlp/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/) **Links:** [Publisher's page](https://aclanthology.org/2026.privatenlp-main.1/) · [PDF](https://aclanthology.org/2026.privatenlp-main.1.pdf) · [DOI 10.18653/v1/2026.privatenlp-main.1](https://doi.org/10.18653/v1/2026.privatenlp-main.1) · [OpenAlex](https://openalex.org/W7166859251) **Citations:** 1 citations (OpenAlex, 2026-10-14) ## Summary This position paper looks at a privacy risk specific to LLM agents. When an agent turns a user's goal into arguments for an external API, it can send more information than the receiving service needs. The authors use Contextual Integrity as their framework and argue that the runtime tool call should be the core unit of privacy analysis. They describe two failure modes: - **within-context over-disclosure**, where a service receives more than the current task requires; - **cross-context leakage**, where details from one task travel into an unrelated service. The broader pattern behind both is called contextual flattening: the agent stops respecting the different disclosure norms of different services. Instead of measuring agent behavior, the study audits the interfaces themselves. It examines 2,344 third-party Action/API specifications from the OpenAI GPT ecosystem and flags unconstrained string parameters with generic names. About 37% of tools contain at least one such open channel. This points to tool-interface design as a privacy lever. The paper closes with an evaluation agenda that looks at tool-call arguments, not just final outputs. ## Key points - **Dataset:** 2,344 unique tool specifications, taken from the Wu et al. (2025) crawl of over 119,000 GPTs and 4,592 Actions (May 2024). - **Schema types:** 1,480 structured-only (63.1%), 204 free-text-only (8.7%) and 660 mixed (28.2%). In total, 864 tools (36.9%) expose a weakly bounded free-text parameter. - **Detection heuristic:** a case-insensitive regex matches generic field names (e.g., query, notes, prompt, context) that have no enum, format or validation constraints. The authors present the result as a conservative structural indicator, not a measured leakage rate. - **Notable example:** One tool, Zapier's AI Actions integration, appears in 231 GPTs. It has an instructions field whose description explicitly asks agents to provide maximal detail. - **Proposed agenda:** cross-context benchmarks, argument-level disclosure metrics (e.g., irrelevant-information rate per call) and controlled studies of structural leakage conditions. The code is released on GitHub (shahriarshayesteh/agentic-disclosure). *Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.* ## Institutions - [Pennsylvania State University](https://md.research.elamur.ai/free/en/universities/pennsylvania-state-university/) — University, State College, United States · 67 works · 5,865 citations 📚 Shelves (5): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [🤝 Social Sciences](https://md.research.elamur.ai/free/en/shelves/social-sciences/) · 1,954 works · [🤝 Safety Research](https://md.research.elamur.ai/free/en/shelves/social-sciences/safety-research/) · 626 works · [🤝 Sociology and Political Science](https://md.research.elamur.ai/free/en/shelves/social-sciences/sociology-and-political-science/) · 626 works 🧭 Topics (1): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,894 works ## Cite Cite as: Shahriar Shayesteh and Shomir Wilson. 2026. From Conventional Web Privacy to Agentic Disclosure: How Tool Schemas May Invite LLM Oversharing. Proceedings of the Seventh Workshop on Privacy in Natural Language Processing. The paper itself, not this page. BibTeX from the library's record of the work. ```bibtex @inproceedings{shayesteh2026conventional, title = {{From Conventional Web Privacy to Agentic Disclosure: How Tool Schemas May Invite LLM Oversharing}}, author = {Shahriar Shayesteh and Shomir Wilson}, booktitle = {Proceedings of the Seventh Workshop on Privacy in Natural Language Processing}, year = {2026}, doi = {10.18653/v1/2026.privatenlp-main.1}, url = {https://doi.org/10.18653/v1/2026.privatenlp-main.1} } ``` - [← previous From Attack Surfaces to Actual Operations: A Survey of Modern LLM Jailbreaks](https://md.research.elamur.ai/free/en/papers/zhou-2026-attack-surfaces-actual-operations-survey/) - [next → From Curated Data to Scalable Models: Continual Pre-training of Dense and MoE Large Language Models for Tibetan](https://md.research.elamur.ai/free/en/papers/yang-2026-curated-data-scalable-models-continual/) - [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/13/) ## References 1 references, 0 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet. 1. Adam Barth, Anupam Datta, John C. Mitchell, and Helen Nissenbaum. 2006. Privacy and contextual integrity: Framework and applications. In Proceedings of the 2006 IEEE Symposium on Security and Privacy, SP ’06, page 184–198, USA. IEEE Computer Society. \#\# Limitations [find](https://scholar.google.com/scholar?q=Adam+Barth%2C+Anupam+Datta%2C+John+C%2E+Mitchell%2C+and+Helen+Nissenbaum%2E+2006%2E+Privacy+and+contextual+integrity%3A+Framework+and+applications%2E+In+Proceedings+of+the+2006+IEEE+Symposium+on+Security+and+Privacy%2C) *Updated 1 November 2026*