Three Privacy Attacks on Personal AI Agents That Use No Prompt Injection at All

arXiv 2609.14003·medium signalXBlueskyLinkedInCopy link

When an agent's privacy enforcement is a judgment the backend LLM makes over the same conversational context an adversary controls, the enforcement mechanism and the attack surface coincide. Three attacks needing only ordinary interaction beat the defenses they target: Collaborative Workspace Lure reframes extraction as collaborative work, Semantic Obfuscation induces disclosure through omission rather than through anything the agent writes, and Channel Decoupling splits the request and the disclosure across independent channels. The proposed fix, FLOWSEAL, moves confidentiality enforcement into a tool-level interceptor outside the LLM's judgment loop.