Google Outlines New Privacy Framework for AI Agents

Google Research has published a collaborative workshop report detailing a new approach to securing autonomous AI agents. Developed alongside more than 50 academic and industry leaders during the Google Contextual Agent Privacy and Security (CAPS) Workshop in late 2025, the paper addresses the unique vulnerabilities of highly autonomous systems. The authors argue that traditional, rigid security permissions cannot scale to handle large language models that dynamically generate plans and execute multi-step tasks.

To resolve these vulnerabilities, the report adapts the sociological theory of Contextual Integrity to AI. This framework defines privacy not as absolute secrecy, but as the appropriate flow of information based on specific social norms. For developers, this means moving away from static, binary access controls. Instead, the researchers advocate for a contextual policy engine that acts as a supervisor layer. This engine dynamically evaluates whether an agent's proposed action or data transfer is socially appropriate for its specific situation before executing it.

The report highlights three main challenges: unstructured interfaces prone to prompt injection, probabilistic control flows that bypass traditional testing, and delegation risks that cause user confirmation fatigue. Addressing these issues requires a multi-layered defense. This includes system-level sandboxing that dynamically adjusts permissions, model-level reasoning to clarify vague user prompts, and new user-centric controls that move past the outdated notice-and-choice model.

For practitioners, these proposals shift how AI systems are built and tested. Rather than relying on static benchmarks, the report calls for the creation of "Agent Gym" environments. These open-source, multi-agent sandboxes will allow developers to safely simulate and evaluate complex, cascading interactions over extended periods. By establishing these dynamic testing grounds, the industry can build a shared baseline for safety and verify that autonomous agents respect contextual norms in real-world deployments.