Excessive Privacy-Sensitive Data Exposure in LLM Agent Tool Calls

Technical Analysis

The entry point is the LLM agent's own argument-construction step when invoking external tools (including MCP servers); the model tends to pass along contextually available PII/PSD even when the tool schema does not require it, including implicit identifiers (e.g., hospital names implying diagnoses) that standard PII detectors miss. This crosses a trust boundary because third-party tool/service providers receive more sensitive data than functionally necessary, increasing exposure risk if those providers are compromised, log data insecurely, or are themselves malicious. No exploitation, injection, or adversarial manipulation is described—the paper measures baseline over-sharing behavior and introduces a schema-aware rewriting layer (removal, generalization, substitution, truncation) plus an optional LLM-based content-necessity filter to mitigate it. The risk is best framed as an agent design/data-governance gap rather than an active attack chain, since no threat actor or malicious input is involved.

Affected Systems

GPT-4o, Claude 3.5 Sonnet, Llama-3.3-70B, MCP-based tool integrations; protocols: MCP

Detection Signatures

• Tool call logs containing full names, addresses, dates of birth, or institution names (e.g., specific hospital/clinic names) in arguments not required by the tool's schema
• High ratio of argument fields populated versus schema 'required' fields
• Free-text fields in tool calls containing named entities unrelated to the tool's stated function
• Absence of 'minimum_necessary' metadata annotations in MCP tool schemas

Remediation Steps

1. 1

   Deploy argument-minimization middleware

   Interpose a schema-aware layer between agent and tool execution that strips, generalizes, substitutes, or truncates arguments to only what the tool schema requires, similar to the ToolMinimize approach.

2. 2

   Annotate tool/MCP schemas with necessity metadata

   Add 'minimum_necessary' or similar field-level annotations to MCP and other tool schemas so automated systems can identify which arguments are functionally required versus optional context.

3. 3

   Apply content-level PSD filtering on free-text fields

   Use an auxiliary LLM or NLP filter to detect and remove task-irrelevant privacy-sensitive content (including implicit PSD) within free-text arguments before transmission to third-party tools.

4. 4

   Audit and log tool-call payloads

   Continuously monitor outbound tool call arguments for PII/PSD volume and flag calls that include unnecessary sensitive fields, feeding results into a privacy-cost metric.

5. 5

   Enforce least-privilege prompting

   Reinforce system prompts and agent instructions to minimize inclusion of sensitive context in tool invocations, while recognizing that prompt-level instructions alone leave significant residual over-sharing.