VisualLeakBench: VLMs leak sensitive text into tool calls 78% of the time

A new paper from researchers Youting Wang, Yuan Tang, and Yitian Qian introduces VisualLeakBench, a 500-image benchmark designed to test a critical failure mode in vision-language agents: action-boundary propagation. In this scenario, sensitive or unsafe text visible in images (like passwords, PII, or offensive content) gets copied verbatim into downstream tool arguments, such as API calls, notes, or external handoffs. The benchmark covers five scene types (UI, chat, document, form, dashboard) and was evaluated on four production VLM systems under two workflows—note capture and external handoff. The results are sobering: at baseline, target strings propagated into tool arguments in 78.8% of PII cases and 85.5% of rendered unsafe-text cases.

When researchers added a defensive system prompt, PII tool propagation dropped to 2.0%—but largely by suppressing tool use entirely, not by filtering content. Rendered unsafe-text propagation remained high at 52.6%, indicating that current defenses are inconsistent. The study also found that propagation rates depend on the tool surface: search-like tools suppressed PII propagation, but unsafe text still crossed boundaries. Importantly, the benchmark focuses on visual-to-tool propagation, not downstream instruction execution, and provides a labeled-target oracle to localize failures at the tool boundary. These findings expose a systemic vulnerability in VLMs used for screen reading and GUI automation, with serious implications for privacy and safety in enterprise deployments.