What happened
The Singapore AI Safety Institute (SG AISI) and the Korea AI Safety Institute (KR AISI) jointly published on 15 June 2026 a rigorous evaluation (arXiv:2606.17114) of data-leakage risks in tool-using LLM agents operating under non-adversarial, routine conditions. The two institutes independently constructed testing pipelines — ReAct-style agent scaffolds, model-simulated users, MCP-based tool environments, and task-specific LLM-judge rubrics — then ran a common set of 12 realistic tasks (employee onboarding, customer support, DevOps, web automation, enterprise productivity) covering five risk categories: lack of data awareness, audience awareness, policy compliance, data minimisation, and access-boundary awareness. The headline finding is stark: across the three tested agents, 'none achieved fully correct and fully safe execution across all scenarios,' and 'successful task completion often coincided with data-handling failures such as accessing unnecessary information or disclosing information to inappropriate recipients.' The paper concludes that 'operational data leakage is a first-order agent-safety concern distinct from adversarial exfiltration' and that capability and data-handling safety must be evaluated separately. Note: preprint, not yet peer-reviewed.
Why it matters
As enterprises deploy LLM agents with access to email, CRM, code repositories, and internal databases, this government-to-government evaluation provides the first systematic, multi-institute evidence that even benign everyday agent use routinely leaks sensitive data — making it the strongest current empirical case for mandatory agent data-handling standards before broad deployment.
Action needed
Require data-handling safety evaluations — distinct from capability benchmarks — as a gate before any enterprise agent deployment that touches sensitive data; review current agent permissions against the five risk categories identified in this paper.