代理式隐私与安全中的开放与新兴问题：上下文视角

Eugene Bagdasarian, Research Scientist, and Marco Gruteser, Principal Scientist, Google Research To be useful, AI agents must understand and be constrained by contextual behavioral norms to ensure they act appropriately. Inspired by the theory of Contextual Integrity, our new workshop report outlines key open research directions across system, model, and user levels to build AI agents users can trust. We're rapidly transitioning to a computing landscape defined by highly general, increasingly autonomous agents . Driven by large language models (LLMs) that can dynamically generate plans and invoke external tools, these systems offer the potential for AI to seamlessly handle complex, multi-step tasks on our behalf. However, realizing this potential requires solving a key challenge: enabling agent capability while ensuring that agents act appropriately. Today, we share a comprehensive new workshop report, " Open and Emergent Problems in Agentic Privacy and Security: A Contextual Angle ," the result of a collaborative effort bringing together more than 50 academic and industry leaders from numerous institutions. We met at the Google Contextual Agent Privacy and Security (CAPS) Workshop, held in late 2025 in New York City. In this report, you’ll find a breakdown of foundational privacy and security challenges that autonomous agents face today, needing coordinated defenses at the system, model, user, and ecosystem levels. The core challenge of agentic AI is that, for an agent to be useful, it may need to have access to personal data and the ability to take consequential actions across a broad range of contexts. However, this access together with agents’ behavioral flexibility requires meaningfully different approaches from those used in traditional software. Unlike traditional deterministic software, agents differ in three critical dimensions that lead to challenges the research community must address together: Unstructured interfaces and input ambiguity : Agents process instructions in formats like natural language and images, which makes it difficult to define "expected behavior" or protect against adversarial manipulations like prompt injection . Probabilistic control flows : Generative planning leads to probabilistic execution paths that traditional testing methodologies can’t easily secure. Autonomy and delegation : As agents handle longer tasks and delegate sub-tasks to other agents, traditional user oversight becomes less effective and likely insufficient, risking "confirmation fatigue". Agentic AI privacy and security challenges. Given that useful agents may need to share data and complete tasks, we believe that the future of trustworthy agents depends on their ability to reason about, understand, and be constrained by the social norms and appropriateness of their actions— for the specific context in which they operate. But how do we teach an agent to understand "context" and appropriateness? Our report is grounded in the theory of Contextual Integrity (CI), which defines privacy not just as secrecy or control, but as "appropriate information flow" according to established and justifiable social norms. A context-specific informational norm is defined by its actors (who is sending and receiving information about whom), the types of information (specific categories of information, like medical or financial records), and transmission principles (the rules governing the flow, like confidentiality or reciprocity). For example, you might be willing to share your gift shopping list with a virtual shopping assistant, but not your family and friends. Our report extends and generalizes contextual integrity for information sharing to contextual security, that is the appropriateness of agent actions. By anchoring agent privacy and security in CI, we explore how we can design systems that evaluate whether an action is socially and contextually appropriate before executing it. Model of a general AI agent interacting with other