AI
Researchers Discover Most LLM Agents Leak Unnecessary Sensitive Data in Tool Calls
A new middleware system called ToolMinimize can intercept and rewrite AI agent requests to eliminate privacy-sensitive information beyond what's actually needed.
Researchers have documented a widespread privacy problem in language model agents: the vast majority inadvertently share sensitive user information when calling external tools, often passing far more data than necessary to third-party services.
The Privacy Leakage Problem#
Testing three major production LLMs—GPT-4o, Claude 3.5 Sonnet, and Llama-3.3-70B—revealed that 81–88% of tool calls include unnecessary privacy-sensitive data (PSD) under standard conditions. Even when developers add explicit privacy instructions to prompts, the over-sharing persists: 36–76% of calls still pass unneeded information. Implicit data leakage poses a particular challenge; conventional PII detection tools often miss contextual hints like hospital names that reveal medical information without stating it directly.
How ToolMinimize Works#
The proposed system operates as a middleware layer that intercepts tool calls before they reach external services. Rather than simply blocking or flagging suspicious requests, it rewrites arguments to include only the minimum data required for the tool to function correctly.
ToolMinimize employs four core techniques:
- Removal — stripping superfluous fields
- Generalization — replacing specific values with broader categories
- Substitution — swapping sensitive data for anonymized proxies
- Truncation — shortening overly detailed strings
A supplementary layer powered by LLMs can further scan free-text fields to remove task-irrelevant sensitive content that would otherwise survive necessity analysis.
Real-World Performance#
Live testing on 307 tool calls across the three LLMs achieved a privacy cost reduction of 81.2–92.0% while maintaining 100% task validity, with statistical equivalence confirmed at the $p<0.001$ level. On 25 unannotated Model Context Protocol (MCP) tool schemas lacking detailed specifications, the system still achieved 79.0% reduction. The optional content-necessity layer boosted live-LLM reduction to 85.1–95.6%. Processing overhead remained minimal: median latency added just 1.77 milliseconds per call.
