Shadow Data in Tool Calls: The Privacy Leak Hiding in Plain Sight
summary
Local agents leak sensitive inputs inside external tool requests: prototype analysis of a smart‑home agent finds a 72% leak rate across sampled calls, with weather and maps highest and calendar/email/search around 57–60%. A working Tool Call Sanitizer on Raspberry Pi intercepts outbound requests, generalizes coordinates to city-level and removes sensitive entity tags, cutting identifiable payload while preserving task utility, with tradeoffs of over‑sanitization and ambiguous context handling.
AI-written summary · about
related talks
49mBeyond Cookies: The Unseen Privacy Risks of Web Analytics
21mHow Software is Developed for Privacy Professionals
30mNavigating the New AI Security Landscape
49mWeb Side Story: A Privacy Odyssey through Tracking and Fingerprinting
28mOwn Goal: How AI Agents Are Quietly Scoring for the Other Side
20mPrivacy Shift Left: A Machine-Assisted Threat Modeling Approach
17mPrivacy Design Flaws
37mHey, You, Get off My Private Data: Do Apps Respect Your Privacy as They Claim?