Research demo
Agentic oversharing: browser agents leak user chat history, email and personal data to e-commerce sites during ordinary shopping tasks
AIR-2026-0061 AIR record · 2026-03-brave-agentic-oversharing-study
From the supporting source
Simply instructing agents to be privacy-conscious at the prompt level is insufficient to address the depth and breadth of natural agentic oversharing.brave.com
The record
Disclosed
2026-03-05
Vendor
Browser Use; Microsoft (AutoGen); OpenAI (models)
Product
Browser-Use; AutoGen (with GPT-4o, o3, o4-mini backbones)
Risk domain
Privacy › Sensitive data exposure
Also touches
Data exfiltration channels
System type
Generative model
Who acted
Agent acted — the browser agents themselves sent chat history and email to shopping sites
Attack surface
Browser agent
Autonomy level
Semi-autonomous
Initial vector
No adversary agent default behavior
Impact type
Privacy violation, Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0057 – LLM Data Leakage
- NIST AI RMF
- MEASURE 2.10
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Use data anonymization; Implement log sanitization to scrub PII.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
users delegating shopping or form-filling to browser agents
Capability abused
Defense & remediation
Recorded defense
prompt-level privacy instructions
Guardrail kinds
Prompt instruction
Guardrail outcome
Silent
Fix shipped
n/a - research recommends context minimization
Taxonomy & references
Curator notes
Brave research: 180 shopping tasks x 3 resource types (chat histories, emails, personal info) on Amazon and eBay = 1,080 runs. Two leakage dimensions - content (what the agent types) and behavior (what it clicks, searches and visits); behavioral oversharing consistently dominated. Removing task-irrelevant context improved task success by up to 17.9%, so privacy and utility aligned. Non-adversarial: the harm comes from the agent's own default behavior.
Supporting sources
Cite as
Enkrypt AI. "Agentic oversharing: browser agents leak user chat history, email and personal data to e-commerce sites during ordinary shopping tasks". AIR, AIR-2026-0061. https://agentincident.vercel.app/i/AIR-2026-0061/ (accessed 2026-10-19).