📄 From Conventional Web Privacy to Agentic Disclosure: How Tool Schemas May Invite LLM Oversharing

Summary

This position paper looks at a privacy risk specific to LLM agents. When an agent turns a user's goal into arguments for an external API, it can send more information than the receiving service needs. The authors use Contextual Integrity as their framework and argue that the runtime tool call should be the core unit of privacy analysis. They describe two failure modes:

• within-context over-disclosure, where a service receives more than the current task requires;
• cross-context leakage, where details from one task travel into an unrelated service.

The broader pattern behind both is called contextual flattening: the agent stops respecting the different disclosure norms of different services.

Instead of measuring agent behavior, the study audits the interfaces themselves. It examines 2,344 third-party Action/API specifications from the OpenAI GPT ecosystem and flags unconstrained string parameters with generic names. About 37% of tools contain at least one such open channel. This points to tool-interface design as a privacy lever. The paper closes with an evaluation agenda that looks at tool-call arguments, not just final outputs.

Key points

• Dataset: 2,344 unique tool specifications, taken from the Wu et al. (2025) crawl of over 119,000 GPTs and 4,592 Actions (May 2024).
• Schema types: 1,480 structured-only (63.1%), 204 free-text-only (8.7%) and 660 mixed (28.2%). In total, 864 tools (36.9%) expose a weakly bounded free-text parameter.
• Detection heuristic: a case-insensitive regex matches generic field names (e.g., query, notes, prompt, context) that have no enum, format or validation constraints. The authors present the result as a conservative structural indicator, not a measured leakage rate.
• Notable example: One tool, Zapier's AI Actions integration, appears in 231 GPTs. It has an instructions field whose description explicitly asks agents to provide maximal detail.
• Proposed agenda: cross-context benchmarks, argument-level disclosure metrics (e.g., irrelevant-information rate per call) and controlled studies of structural leakage conditions. The code is released on GitHub (shahriarshayesteh/agentic-disclosure).