Open and Emergent Problems in Agentic Privacy and Security: A Contextual Angle

We're rapidly transitioning to a computing landscape defined by highly general, increasingly autonomous agents. Driven by large language models (LLMs) that can dynamically generate plans and invoke external tools, these systems offer the potential for AI to seamlessly handle complex, multi-step tasks on our behalf. However, realizing this potential requires solving a key challenge: enabling agent capability while ensuring that agents act appropriately.

Today, we share a comprehensive new workshop report, "Open and Emergent Problems in Agentic Privacy and Security: A Contextual Angle," the result of a collaborative effort bringing together more than 50 academic and industry leaders from numerous institutions. We met at the Google Contextual Agent Privacy and Security (CAPS) Workshop, held in late 2025 in New York City. In this report, you’ll find a breakdown of foundational privacy and security challenges that autonomous agents face today, needing coordinated defenses at the system, model, user, and ecosystem levels.

Agentic trade-offs

The core challenge of agentic AI is that, for an agent to be useful, it may need to have access to personal data and the ability to take consequential actions across a broad range of contexts. However, this access together with agents’ behavioral flexibility requires meaningfully different approaches from those used in traditional software. Unlike traditional deterministic software, agents differ in three critical dimensions that lead to challenges the research community must address together:

The contextual lens

Given that useful agents may need to share data and complete tasks, we believe that the future of trustworthy agents depends on their ability to reason about, understand, and be constrained by the social norms and appropriateness of their actions— for the specific context in which they operate.