PiSAs benchmark exposes privacy risks in multi-user AI agent systems

As LLM agents transition from single-user assistants to shared organizational infrastructure, privacy risks multiply—not just from external output leaks but also from internal cross-user data spillage via inter-agent messages, shared memory, and agent interactions. A new benchmark called PiSAs (Privacy in Shared Agentic Systems), introduced by Shubham Gupta and eight co-authors, directly addresses this blind spot. Unlike existing privacy benchmarks that focus on single-user or independently owned agent settings, PiSAs evaluates systems using dual contextual integrity (CI) annotations: one for whether information is appropriate for the task, another for which users may legitimately access it. This allows precise measurement of unauthorized data flow across agent components and interfaces.

PiSAs is system-agnostic, supporting evaluation across different agent topologies and memory regimes. The research team tested several modern LLM architectures and found that even state-of-the-art models struggled to reliably filter inappropriate content or restrict transmission to authorized users. Incorrect LLM judgment calls were the primary bottleneck—system design improvements helped but did not eliminate the problem. These findings underscore the urgent need for privacy-preserving strategies beyond current approaches, as shared multi-user agents become more prevalent in workplaces and collaborative environments.