Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents

The Shift to Data Agents

Large language models have evolved from simple chatbots into autonomous agents that perform multi-step workflows, maintain persistent memory, and interact with diverse external data sources. The authors define these as "data agents"—systems designed to query, retrieve, transform, and act on sensitive information. Unlike traditional chatbots, where privacy could be managed by filtering a single final output, data agents operate across multiple, heterogeneous surfaces, making privacy enforcement significantly more complex.

A Data-Centric Taxonomy

The paper argues that current research is fragmented across different communities, such as retrieval-augmented generation (RAG), text-to-SQL, and agent memory. To unify this, the authors propose a data-centric taxonomy that organizes privacy risks and governance mechanisms around the data surfaces an agent touches. These surfaces include relational databases, file systems, RAG vector indexes, external APIs, agent memory, and inter-agent communication channels. By mapping these surfaces to specific disclosure outcomes—such as intermediate-step leakage or compositional inference—the authors provide a structured framework for system builders to identify where sensitive data is most vulnerable.

Governance and Benchmarking

A key contribution of this survey is the evaluation of existing governance mechanisms. The authors conclude that while various tools exist, most are insufficient for the multi-step, stateful nature of modern agents. Information-flow control stands out as the most robust mechanism, as it is the only approach that effectively tracks data as it moves through an agent's workflow, thereby mitigating risks like cross-session leakage. Furthermore, the authors identify a critical gap in the field: the lack of a standardized, end-to-end benchmark that evaluates an agent's privacy performance across all its data surfaces under a single, unified policy.

As organizations increasingly deploy agents to handle sensitive enterprise and personal data, the current "siloed" approach to security is insufficient. This survey provides a necessary reference for researchers and developers to move beyond component-level security and toward a holistic, system-wide privacy architecture. By identifying the most effective governance tools and highlighting the urgent need for comprehensive benchmarks, the paper sets a clear agenda for future research in agentic privacy.