**SPILLage：网络中的代理性过度分享**

SPILLage: Agentic Oversharing on the Web

February 13, 2026

作者: Jaechul Roh, Eugene Bagdasarian, Hamed Haddadi, Ali Shahin Shamsabadi

cs.AI

摘要

基于大语言模型的智能体正逐步实现开放互联网场景下用户任务的自动化执行，这些智能体通常具备访问用户资源（如电子邮件和日历）的权限。与在受控聊天机器人环境中回答问题的标准大语言模型不同，网络智能体在"开放环境"中运行，通过与第三方交互留下行为轨迹。因此我们提出关键问题：当网络智能体在真实网站上代用户执行任务时，它们如何处理用户资源？本文正式提出"自然智能体过载共享"概念——即智能体在网络行为轨迹中无意泄露与任务无关的用户信息。我们引入SPILLage框架，从渠道（内容vs行为）和直接性（显式vs隐式）两个维度对过载共享进行表征。该分类法揭示了一个关键盲点：既有研究主要关注文本泄露，而网络智能体还会通过可被监控的点击、滚动和导航模式进行行为层面的过载共享。我们在真实电商平台上对180项任务进行基准测试，并通过真实标注区分任务相关与无关属性。通过对两种智能体框架和三种骨干大语言模型的1,080次运行实验，我们发现过载共享现象普遍存在，其中行为过载共享量是内容过载共享的5倍。即使在提示级缓解措施下，该现象依然存在（甚至可能加剧）。然而，在执行前移除任务无关信息可使任务成功率提升高达17.9%，表明减少过载共享能提升任务效能。我们的研究结果强调，保护网络智能体隐私是根本性挑战，需要拓展对"输出"的认知范畴——不仅要关注智能体输入的内容，更要监控其在网络上的行为轨迹。数据集与代码已开源：https://github.com/jrohsc/SPILLage。

English

LLM-powered agents are beginning to automate user's tasks across the open web, often with access to user resources such as emails and calendars. Unlike standard LLMs answering questions in a controlled ChatBot setting, web agents act "in the wild", interacting with third parties and leaving behind an action trace. Therefore, we ask the question: how do web agents handle user resources when accomplishing tasks on their behalf across live websites? In this paper, we formalize Natural Agentic Oversharing -- the unintentional disclosure of task-irrelevant user information through an agent trace of actions on the web. We introduce SPILLage, a framework that characterizes oversharing along two dimensions: channel (content vs. behavior) and directness (explicit vs. implicit). This taxonomy reveals a critical blind spot: while prior work focuses on text leakage, web agents also overshare behaviorally through clicks, scrolls, and navigation patterns that can be monitored. We benchmark 180 tasks on live e-commerce sites with ground-truth annotations separating task-relevant from task-irrelevant attributes. Across 1,080 runs spanning two agentic frameworks and three backbone LLMs, we demonstrate that oversharing is pervasive with behavioral oversharing dominates content oversharing by 5x. This effect persists -- and can even worsen -- under prompt-level mitigation. However, removing task-irrelevant information before execution improves task success by up to 17.9%, demonstrating that reducing oversharing improves task success. Our findings underscore that protecting privacy in web agents is a fundamental challenge, requiring a broader view of "output" that accounts for what agents do on the web, not just what they type. Our datasets and code are available at https://github.com/jrohsc/SPILLage.