网络信息泄露：网络环境下的代理性过度分享

SPILLage: Agentic Oversharing on the Web

February 13, 2026

作者: Jaechul Roh, Eugene Bagdasarian, Hamed Haddadi, Ali Shahin Shamsabadi

cs.AI

摘要

基于大语言模型的智能体正逐渐实现开放互联网中用户任务的自动化，这些智能体通常具备访问用户资源（如电子邮件和日历）的权限。与在受控聊天机器人环境中回答问题的标准大语言模型不同，网络智能体在"开放环境"中运行，通过与第三方交互留下行为轨迹。因此我们提出核心问题：当网络智能体在真实网站上代用户执行任务时，会如何处理用户资源？本文正式提出"自然智能体过度共享"概念——即智能体在网络行为轨迹中无意泄露与任务无关的用户信息。我们引入SPILLage框架，从两个维度（渠道维度：内容vs行为；直接性维度：显性vs隐性）系统化表征过度共享现象。该分类法揭示了一个关键盲点：既有研究主要关注文本泄露，而网络智能体同样会通过可被监控的点击、滚动和导航模式进行行为层面的过度共享。我们在真实电商网站上对180项任务进行基准测试，通过人工标注严格区分任务相关与无关属性。涵盖两种智能体框架和三种骨干大语言模型的1,080次实验表明，过度共享现象普遍存在，其中行为过度共享量级是内容过度共享的5倍。这种效应在提示级缓解措施下持续存在甚至加剧。但若在执行前剔除任务无关信息，任务成功率最高可提升17.9%，证明减少过度共享能提升任务效能。我们的研究结果强调：保护网络智能体隐私是根本性挑战，需要拓展对"输出"的认知范畴——不仅要关注智能体输入的内容，更要关注其在网络上的行为轨迹。数据集与代码已开源：https://github.com/jrohsc/SPILLage。

English

LLM-powered agents are beginning to automate user's tasks across the open web, often with access to user resources such as emails and calendars. Unlike standard LLMs answering questions in a controlled ChatBot setting, web agents act "in the wild", interacting with third parties and leaving behind an action trace. Therefore, we ask the question: how do web agents handle user resources when accomplishing tasks on their behalf across live websites? In this paper, we formalize Natural Agentic Oversharing -- the unintentional disclosure of task-irrelevant user information through an agent trace of actions on the web. We introduce SPILLage, a framework that characterizes oversharing along two dimensions: channel (content vs. behavior) and directness (explicit vs. implicit). This taxonomy reveals a critical blind spot: while prior work focuses on text leakage, web agents also overshare behaviorally through clicks, scrolls, and navigation patterns that can be monitored. We benchmark 180 tasks on live e-commerce sites with ground-truth annotations separating task-relevant from task-irrelevant attributes. Across 1,080 runs spanning two agentic frameworks and three backbone LLMs, we demonstrate that oversharing is pervasive with behavioral oversharing dominates content oversharing by 5x. This effect persists -- and can even worsen -- under prompt-level mitigation. However, removing task-irrelevant information before execution improves task success by up to 17.9%, demonstrating that reducing oversharing improves task success. Our findings underscore that protecting privacy in web agents is a fundamental challenge, requiring a broader view of "output" that accounts for what agents do on the web, not just what they type. Our datasets and code are available at https://github.com/jrohsc/SPILLage.