Agent privacy tests separate legitimate task data needs from requester authority

An assistant can correctly recognize that a piece of private data is needed to complete a task yet fail the separate question of whether the requester is entitled to receive it.

The contextual-integrity experiments separated genuine need from requester authority and reported frequent disclosure in Type III scenarios across synthetic bank, identity and address examples. Small samples and artificial data limit generalization.

The study isolates two questions that assistants often collapse: whether a sensitive item would help finish a task and whether this particular requester is entitled to receive it. Its Type III scenarios intentionally make the need genuine while withholding recipient authority. Failure in those trials is therefore not simply a model misunderstanding the task or missing a generic privacy keyword. The reported results use synthetic identity and bank records, with small per-model groups, so they cannot establish a population breach rate. The operational control is to authenticate the recipient and bind the disclosure purpose before data leaves the assistant, including when a downstream tool makes the transfer.

A legitimate task need is not sufficient authority to disclose the data to whoever asks. In the study's Type III scenarios the information is relevant, but the requester lacks permission; Type IV keeps the same task relevance while authorizing the recipient. This tests a different failure from ordinary prompt injection because the model can be cooperative and still route a truthful answer to the wrong principal. The reported nine-example subgroups are small, so the observed withholding rates are evidence of a boundary error under test conditions, not population-level disclosure probabilities.