SPILLage: Agentic Oversharing on the Web

• Web agents receive access to user resources such as email and calendars, creating an expectation that task-irrelevant information will not be disclosed to external parties.The paper calls this unintentional disclosure of task-irrelevant user information through an agent’s web-action trace natural agentic oversharing.Source: §1 · p. 1
• SPILLAGE classifies oversharing by disclosure channel (content or behavior) and directness (explicit or implicit), capturing behavioral traces such as clicks, scrolling, and navigation.The four channels include explicit or implicit information entered in fields and explicit or implicit disclosure through actions and action patterns.Source: §1 · p. 1, Figure 1 · p. 2
• Across 1,080 runs, oversharing was pervasive across tested configurations; a gpt-4o agent committed 1,151 explicit behavioral oversharing events on Amazon, and removing task-irrelevant information improved task success by up to +17.9%.The experiments spanned two frameworks and three GPT backbones; backbones exhibited distinct oversharing profiles.Source: §1 · pp. 2–3
• SPILLAGE introduces a 2×2 taxonomy of web-agent oversharing spanning directness (explicit or implicit) and channel (content or behavioral), capturing behavioral disclosure unique to agentic systems for the first time.Source: §1 · p. 3
• The paper builds a live-site benchmark on Amazon and eBay, using persona-rich mixed-context prompts and step-level LLM-Judge annotations of actions and state or memory updates.Tasks use chat-history, email, and generic prompt styles, and the judge produces step-level oversharing annotations across agent trajectories.Source: §1 · pp. 2–3

Related Work

• Unlike chatbots confined to user-provided text, web agents interpret instructions and interact with live websites to complete tasks from information retrieval to transactions.They visit websites, process structured page representations such as DOM hierarchies, and interact with interface elements (Zhou et al., 2024; Liang et al., 2023).Source: §2 · p. 3
• Contextual integrity evaluates whether information flows conform to context-specific norms, including who sends and receives information, its type, and the governing transmission principle.For delegated shopping, users reasonably expect an agent with access to personal resources to convey only information necessary for the task.Source: §2 · p. 3
• Prior frameworks focus on content-based disclosures, miss implicit oversharing inferable from actions, and treat oversharing as binary rather than graded.The cited work on contextual norm violations and unnecessary data access (Zharmagambetov et al., 2025) overlooks behavioral oversharing and detects only verbatim disclosures.Source: §2 · p. 3
• SPILLage targets non-adversarial oversharing arising from an agent’s own task-execution behavior on live websites, without an external attack or platform misconfiguration.The paper distinguishes this category from other web-agent privacy risks discussed in Appendix A.1.Source: §2 · p. 3

3. Problem Statement

• Agentic Natural Oversharing is task-irrelevant user information disclosed to external parties through observable website interactions during ordinary task execution, without adversarial manipulation.Source: §3 · p. 3

3.1. Parties and goals

• A prompt combines a task request with access to resources; attributes are task-relevant only when necessary, and the agent should avoid exposing the rest.For a request to find affordable glucose test strips, Type 2 diabetes and Amazon are relevant, while divorce and income are not.Source: §3.1 · pp. 3–4
• The agent produces an ordered trace of text-entry and navigation actions, through which irrelevant attributes may be disclosed explicitly or implicitly as content or behavior.The four categories are Explicit Content, Implicit Content, Explicit Behavioral, and Implicit Behavioral oversharing.Source: §3.1 · p. 4, Figure 2 · p. 4
• A passive observer records the agent’s observable actions and infers irrelevant information, but cannot access the original request or internal reasoning or manipulate website content.Website operators logging requests and analytics recording page views, clicks, or scrolls can serve as observers.Source: §3.1 · p. 4

4.1. Oversharing Taxonomy

• SPILLAGE classifies oversharing across content versus behavior and explicit versus implicit disclosure, yielding four categories: CE, CI, BE, and BI.Content includes textual inputs, while behavior includes navigation actions such as clicks, filters, and scrolling; explicit disclosure is verbatim, whereas implicit disclosure is inferable.Source: Figure 3 · p. 4, §4 · p. 4, §4.1 · p. 5
• The two dimensions guide defenses, identify potential observers, and distinguish missing output filtering from failures to reason about what observers can infer.Text filtering does not catch behavioral oversharing, string matching does not catch implicit oversharing, and navigation may be logged by intermediate trackers.Source: §4.1 · p. 5

4.2. Auditing Oversharing

• The audit maps each action to oversharing events by identifying an irrelevant attribute, its channel, and whether it appears verbatim or is inferable.The evaluator uses string matching for explicit cases and semantic reasoning for implicit cases, given the prompt, action, and agent’s declared next goal.Source: §4.2 · p. 5

4.3. Dataset creation for user requests and user resources

• The benchmark uses Amazon and eBay tasks with ground-truth relevant and irrelevant attributes, realistic prompts, and live websites where agents choose queries and navigation paths.Synthetic personas are generated from shopping tasks and 10 attributes, manually partitioned by relevance, rendered in chat, email, and generic styles, then manually validated.Source: §4.3 · pp. 5–6
• The figure caption reports oversharing across all evaluated combinations and substantially higher rates on Amazon, especially for email-style tasks.It covers AutoGen and Browser-Use, three prompt styles, and gpt-4o, o3, and o4-mini.Source: Figure 4 · p. 6

5.1. Oversharing is Pervasive

• Oversharing occurred in every configuration; Browser-Use had higher absolute counts, AutoGen higher per-step rates, and Amazon more oversharing than eBay.For explicit behavioral oversharing, AutoGen’s rate was 0.610 [0.444, 0.786] versus Browser-Use’s 0.326 [0.257, 0.395] on Amazon, and 0.684 [0.519, 0.860] versus 0.304 [0.224, 0.392] on eBay.Source: §5.1 · p. 6, Table 1 · p. 7, Table 2 · p. 7

5.2. Explicit Oversharing

• Behavioral oversharing exceeded content oversharing 5× on Amazon with Browser-Use (905 vs. 182 events) and 7× on eBay with AutoGen (342 vs. 46).The pattern held across models and prompt types, and behavioral oversharing can reveal the same irrelevant attribute through an action such as clicking a filter without typing it.Source: §5.2 · p. 7

5.3. Implicit Oversharing

• Implicit oversharing was less frequent but substantial: on Amazon, gpt-4o produced 325 content and 45 behavioral events, compared with o3’s 12 and 8.On Amazon, implicit content rates were 0.171 for generic, 0.127 for chat, and 0.046 for email; implicit oversharing can evade string-matching defenses and accumulate inferential risk across a trajectory.Source: §5.3 · p. 8

5.4. Oversharing versus Defenses and Utility

• With an added instruction to avoid irrelevant attributes, oversharing rate increased from 58.9% to 86.0% in a preliminary Browser-Use test.The test covered 13 personas using gpt-4o on Amazon with chat prompts; qualitative inspection suggested the instruction may increase the salience of irrelevant information in reasoning and create longer action traces.Source: §5.4 · p. 8
• Removing task-irrelevant information improved task success by up to 17.9%, with Browser-Use accuracy rising from 73.4% to 99.4%.Both frameworks improved against their respective baselines, and Amazon and eBay reached near-perfect accuracy across most prompt styles.Source: §5.4 · p. 8, Table 4 · p. 8

6.1. Implications for Defense Design

• Filtering task-irrelevant information before execution improves privacy and utility, while behavioral oversharing dominates content by 5×.Frameworks do not separate task-relevant from task-irrelevant information before acting, and backbones propagate user context differently; the authors explore sanitization and leave action-level monitoring and model-aware guardrails for future work.Source: §6.1 · p. 8

6.2. Limitations and Future Work

• The evaluation is limited to OpenAI models, e-commerce tasks, and single-website sessions, although its taxonomy and methodology can extend to other domains.A qualitative study of Brave AI Browsing, ChatGPT Atlas, and Perplexity Comet finds production systems vary widely in privacy preservation; cross-site traces could enable richer inference attacks through behavioral patterns across third-party trackers.Source: §6.2 · pp. 8–9

7. Conclusion

• Behavioral oversharing dominated content oversharing by 5× across 1,080 runs on live e-commerce sites.The evaluation covered two web-agent frameworks and three models.Source: §7 · p. 9
• Removing task-irrelevant information before execution improved task success by up to 17.9%.The finding suggests privacy and utility can be aligned.Source: §7 · p. 9
• SPILLAGE introduced a 2 × 2 taxonomy of content and behavioral oversharing in explicit and implicit forms.The framework audits oversharing by web agents.Source: §7 · p. 9
• SPILLAGE extends privacy analysis beyond text to observable web actions and provides a foundation for agents that respect contextual integrity.The conclusion characterizes oversharing as pervasive.Source: §7 · p. 9

A.1. Existing Approaches in Privacy Analyses of Web Agents

• SPILLAGE captures all four oversharing types on live websites, unlike prior work that often examined only one channel or disclosure type or used simulated environments.The comparison covers content versus behavior and explicit versus implicit disclosure.Source: §A.1 · p. 11
• The reviewed risks arise from platform configuration, network metadata, adversarial manipulation, or agent reasoning, and each falls outside the paper’s specific threat model.The paper focuses instead on oversharing through an agent’s task-execution trace on live websites.Source: §A.1 · p. 11
• Ukani et al. (2025) show that framework misconfiguration can disable browser protections, degrading baseline privacy independently of task execution; this is orthogonal to the paper’s focus.Examples include cookie-consent defaults, tracker blocking, and fingerprinting defenses.Source: §A.1 · p. 11
• Jeong et al. (2026) show that network observers can infer sensitive traits from visited domains and timing, but study network metadata rather than the agent’s on-page actions.The cited examples of inferred traits include health conditions and political orientation.Source: §A.1 · p. 11
• Adversarial extraction studies assume attackers manipulate web content or intercept model internals, whereas this paper assumes unmodified websites and no external attacker.Prior examples include prompt injection, context hijacking, and leaks from chain-of-thought traces.Source: §A.1 · p. 11
• Zharmagambetov et al. (2025) and Shao et al. (2025) find a privacy knowledge–action gap, but their text-only or binary evaluations miss behavioral leakage and explicit/implicit distinctions.These studies are closest to the paper’s motivation.Source: §A.1 · p. 11

A.2. Why Do Agents Overshare?

• Rich agent inputs lack mechanisms to separate task-relevant from incidental personal information, while dense shopping tasks and multi-step decisions create opportunities for textual and behavioral disclosure.Browser-Use has more oversharing opportunities because it produces longer trajectories; AutoGen uses fewer steps but has higher per-step oversharing rates.Source: §A.2 · pp. 11–12
• Models shift oversharing between reasoning traces, external actions, and planning files: gpt-4o repeats persona details, o3 embeds incidental preferences in actions, and o4-mini writes intent-tracking todo.md files.Table 6 indicates all models filter health information but vary in lifestyle-preference oversharing.Source: §A.2 · p. 12, Table 6 · p. 12

B.1. Web Agent Frameworks

• Browser-Use exposes incremental clicks, keystrokes, scrolling, and navigation across longer traces, whereas AutoGen selects higher-level actions from multimodal webpage observations and compresses tasks into fewer steps.Browser-Use spreads decisions across more actions, each tending to carry less information than AutoGen’s higher-level steps; AutoGen’s compressed actions can concentrate task-irrelevant context.Source: §B.1 · pp. 12–13

B.2. Notations

• The notation distinguishes task-relevant attributes Sr from task-irrelevant attributes Si in user resources R and represents an agent’s textual or behavioral actions as trace A monitored by observer O.Each user prompt P combines a task request with access to those resources.Source: §B.2 · p. 13

B.3. Benchmark Construction

• Synthetic personas are built by defining a shopping task and 10 attributes, manually partitioning relevant from irrelevant attributes, and rendering each persona in three prompt styles.Figure 5 shows the prompt for generating synthetic chat histories with naturally embedded sensitive attributes.Source: §B.3 · p. 14, Figure 5 · p. 14

B.4. Oversharing Detection

• An LLM judge examines each agent action for explicit and implicit oversharing across content and behavioral channels.The evaluation prompt template covers all four taxonomy categories.Source: §B.4 · p. 15, Figure 6 · p. 15

B.5. Utility (Task Completion) Evaluation

• AutoGen task completion is assessed with a prompt template, whereas Browser-Use logs success through built-in completion detection.The referenced AutoGen template is shown in Figure 7.Source: §B.5 · p. 16, Figure 7 · p. 16

B.6. Example Prompts

• The example-prompt subsection presents examples of each prompt style and highlights task-irrelevant information in red.The examples include generic-request, chat, and forwarded-email styles.Source: §B.6 · p. 16
• Figure 8 shows a generic-request-style prompt used for oversharing evaluation, with task-irrelevant information highlighted in red.Source: Figure 8 · p. 16
• Figure 9 presents a chat-style prompt with task-irrelevant information highlighted in red.Source: Figure 9 · p. 17
• Figure 10 presents a forwarded-email-style oversharing prompt, highlighting task-irrelevant personal and preference-based information in red.Source: Figure 10 · p. 17

C.1. Task Success Rates

• AutoGen overall accuracy is 0.792–0.994 versus Browser-Use’s 0.742–0.929; AutoGen utility exceeds 0.97 for o3 and o4-mini, while Browser-Use scores 0.742 (gpt-4o) to 0.761 (o3).AutoGen’s gpt-4o utility score is 0.861.Source: §C.1 · pp. 17–18, Table 8 · p. 18
• AutoGen’s streamlined orchestration typically uses fewer steps, reducing failure opportunities and stabilizing completion, but shorter trajectories also mean fewer oversharing opportunities.The passages caution that this efficiency can mask deeper vulnerabilities on tasks requiring extended reasoning or exploration.Source: §C.1 · p. 18

C.2. Explicit Oversharing: Additional Models

• 0.616 (eBay) and 0.852 (Amazon) are cited AutoGen per-step oversharing rates in generic o4-mini runs, while Browser-Use produces more total leaks on both sites.The cited Browser-Use totals are 220 explicit behavioral leaks on eBay and 674 explicit behavioral plus 382 explicit content leaks on Amazon.Source: Table 9 · p. 18, Table 10 · p. 19

C.3. Implicit Oversharing: Additional Models

• 37 implicit content leaks occurred on Amazon with o4-mini; implicit oversharing was relatively low, generic prompts triggered more leaks, and Amazon had more oversharing than eBay across both models.The reported Amazon content ORs for o4-mini were 0.027 [0.010, 0.047] (chat), 0.017 [0.003, 0.035] (email), and 0.061 [0.035, 0.089] (generic).Source: Table 11 · p. 19

C.4. Oversharing Examples

• Table 12 illustrates how task-irrelevant information propagates through textual content or behavioral actions, covering the SPILLAGE taxonomy’s oversharing categories.The examples are based on the prompt shown in Figure 1.Source: §C.4 · p. 20, Table 12 · p. 20
• Perplexity Comet propagates task-irrelevant user information during Amazon interactions, whereas Brave AI Browsing and ChatGPT Atlas rely exclusively on task-relevant content for shopping tasks.The comparison characterizes Brave AI Browsing and ChatGPT Atlas as respecting user privacy expectations.Source: Table 13 · p. 21

D. An Empirical Study of Oversharing in Commercial Web Agents

• The researchers evaluated Brave AI Browsing, ChatGPT Atlas, and Perplexity Comet on ten persona-rich shopping prompts using manual monitoring and structured inspection.They used these methods because public APIs were unavailable.Source: D. An Empirical Study of Oversharing… · p. 21
• Brave AI Browsing and ChatGPT Atlas completed tasks without oversharing, while Perplexity Comet pasted conversation details that exposed sensitive information to third-party websites.The disclosed information included trauma history, medication usage, and employer details; the authors identify agent information selection, utility priorities, guardrails, and architecture as possible causes for future study.Source: D. An Empirical Study of Oversharing… · p. 21, Figure 11 · p. 22, Figure 12 · p. 23