{"slug": "show-hn-agentleak-open-source-privacy-testing-for-multi-agent-llm-systems", "title": "Show HN: AgentLeak – open-source privacy testing for multi-agent LLM systems", "summary": "The AgentLeak research benchmark, published in IEEE Access (2026) and accompanied by arXiv preprint v3, evaluated 1,000 scenarios across healthcare, finance, legal and corporate domains over 4,979 validated execution traces from five models, finding that internal channels leak at a 74.0% rate versus 28.2% for final outputs. The benchmark instruments seven channels (C1 final outputs, C2 inter-agent messages, C3 tool inputs, C4 tool outputs, C5 shared memory, C6 logs, C7 artifacts), with large-scale analysis covering only C1/C2/C5, and reports that output-only audits miss 45.9% of violations. A separate installable tool, agentleak, provides a Python SDK, CLI, local web UI and CI checks for detecting sensitive data disclosed through tool calls, shared memory, inter-agent messages, logs and generated files, with core trace analysis running locally without an LLM dependency.", "body_md": "Benchmark for privacy leakage in multi-agent LLM systems.\n\nThis repository accompanies the IEEE Access paper: *AgentLeak: A Benchmark for Internal-Channel Privacy Leakage in Multi-Agent LLM Systems*.\n\nPreprint (v3): [https://arxiv.org/abs/2602.11510v3](https://arxiv.org/abs/2602.11510v3)\n\nIEEE Access (2026): [https://doi.org/10.1109/ACCESS.2026.3704541](https://doi.org/10.1109/ACCESS.2026.3704541)\n\nFor the installable privacy-testing tool, see **[yagobski/agentleak](https://github.com/yagobski/agentleak)** and **[agentleak.org](https://www.agentleak.org/?utm_source=research_repo&utm_medium=readme&utm_campaign=oss_visibility_202609)**.\n\nThe practical tool provides a Python SDK, CLI, local web UI and CI checks for sensitive data disclosed through tool calls, shared memory, inter-agent messages, logs, generated files and final outputs. Core trace analysis runs locally without an LLM dependency; optional live-agent runs use the endpoint you configure.\n\nTry a bundled synthetic example with Python 3.10+:\n\n```\npip install agentleak\nagentleak run --scenario healthcare_patient_summary\n```\n\nThe example illustrates a clean final answer alongside internal-channel disclosures. It is a demonstration, not a production leakage-rate estimate. Follow the [tool quickstart](https://github.com/yagobski/agentleak/blob/main/docs/quickstart.md) to analyze your own traces.\n\nThis repository remains the research benchmark and reproduction code. Its experiments, channel definitions and detection pipeline should be cited separately from the practical tool's deterministic analysis and bundled examples.\n\nThe [paper (v3)](https://arxiv.org/abs/2602.11510v3) evaluates **1,000 scenarios** across healthcare, finance, legal, and corporate domains, with **4,979 validated execution traces** across five models. AgentLeak instruments seven channels: **C1** final outputs, **C2** inter-agent messages, **C3** tool inputs, **C4** tool outputs, **C5** shared memory, **C6** logs, and **C7** artifacts. The large-scale analysis covers **C1/C2/C5**; **C3/C6** are evaluated on a sample; **C4/C7** are examined in an integration study. These channels therefore do not all have the same empirical coverage. The validated trace count is also recorded in [`paper_stats.json`](https://github.com/Privatris/AgentLeak/blob/main/benchmarks/ieee_repro/results/paper_stats.json).\n\nThe table and findings below are preserved from the existing README as a separate repository summary. Their stated 5,694-trace basis and reported rates have **not been reconciled** with the paper's 4,979 validated traces. Do not interpret them as the paper's validated results or combine the two denominators; consult the paper for its reported results and evaluation scope.\n\n| Model | C1 (Output) | C2 (Internal) | H1 (Audit Gap) | Total Leak | \n|---|---|---|---|---|\n| **Claude-3.5-Sonnet** | 8.2% | 53.9% | 45.7% | 55.2% | \n| GPT-4o | 17.2% | 76.8% | 59.6% | 77.6% | \n| GPT-4o-mini | 41.2% | 75.3% | 34.2% | 76.3% | \n| Llama-3.3-70B | 26.9% | 67.8% | 41.3% | 89.9% | \n| Mistral-Large | 47.5% | 96.2% | 48.7% | 99.3% | \n| **Average** | **28.2%** | **74.0%** | **45.9%** | **79.7%** | \n\n- **Internal channels leak 2.6× more** than external (74.0% vs 28.2%)\n- **Output-only audits miss 45.9%** of violations\n- **Claude 3.5 Sonnet paradox** : Lowest C1 leakage (8.2%) but 6.6× internal/external ratio—the highest among all models\n- **Finding 7 (Tool Leakage)** : Tool inputs (C3) and system logs (C6) exhibit extremely high leakage rates (up to**85%** on Claude 3.5), even when the final agent output (C1) is perfectly sanitized.\n- Pattern C2 > C1 holds **across all 5 models** tested\n\n- 1,000 scenarios (healthcare, finance, legal, corporate)\n- 7 channels: C1 output, C2 inter-agent, C3-C4 tools, C5 memory, C6 logs, C7 artifacts\n- 32 attack classes, 6 families\n- SDK: CrewAI, LangChain, AutoGPT, MetaGPT\n\nTo reproduce the main results (Output, Internal, Memory):\n\n```\ncd benchmarks/ieee_repro\npython benchmark.py --n 1000 --traces --model openai/gpt-4o\n```\n\nTargets \"Secondary Channel\" leakage where sensitive data is sent to external tools or dumped in logs.\n\n```\ncd benchmarks/ieee_repro\n# Run for a specific model (e.g., Claude 3.5)\npython benchmark_tools.py --n 100 --model anthropic/claude-3.5-sonnet\n\n# Or run the automated multi-model test suite\n./run_tools_benchmark.sh\n```\n\nResults are saved in `benchmarks/ieee_repro/results/tools/`.\n\n- `agentleak/` : The core framework SDK\n- `agentleak_data/` : The dataset of 1000 scenarios\n- `benchmarks/ieee_repro/` : Scripts to reproduce the paper's findings, including Finding 7 (Tools & Logs).\n- `benchmarks/showcase/` : Real-world CrewAI integration demo showing the SDK in action.\n- `paper/` : The LaTeX source of the IEEE Access paper\n\n```\ngit clone https://github.com/Privatris/AgentLeak\ncd AgentLeak\npip install -e .\npytest tests/ -v\npython\nfrom agentleak import AgentLeakTester, DetectionMode\n\ntester = AgentLeakTester(mode=DetectionMode.HYBRID)\nresult = tester.check(\n    vault={\"ssn\": \"123-45-6789\"},\n    output=\"The SSN is 123-45-6789\",\n    channel=\"C1\"\n)\nprint(f\"Leak: {result.leaked}, Confidence: {result.confidence}\")\n```\n\nCLI:\n\n```\npython -m agentleak run --quick --dry-run\npython -m agentleak run --full\ncd benchmarks/ieee_repro\npython benchmark.py --n 100 --traces --model openai/gpt-4o-mini\n```\n\nTraces are in `benchmarks/ieee_repro/results/traces/`.\n\n```\n@article{el2026agentleak,\n  title   = {AgentLeak: A Benchmark for Internal-Channel Privacy Leakage in Multi-Agent LLM Systems},\n  author  = {El Yagoubi, Faouzi and Badu-Marfo, Godwin and Al Mallah, Ranwa},\n  journal = {IEEE Access},\n  year    = {2026},\n  doi     = {10.1109/ACCESS.2026.3704541},\n  url     = {https://doi.org/10.1109/ACCESS.2026.3704541}\n}\n```\n\nMIT", "url": "https://wpnews.pro/news/show-hn-agentleak-open-source-privacy-testing-for-multi-agent-llm-systems", "canonical_source": "https://github.com/Privatris/AgentLeak", "published_at": "2026-11-13 01:36:36+00:00", "updated_at": "2026-11-13 02:21:45.521320+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "large-language-models", "ai-research", "ai-tools"], "entities": ["AgentLeak", "IEEE Access", "arXiv", "Claude-3.5-Sonnet", "GPT-4o", "GPT-4o-mini", "Llama-3.3-70B", "Mistral-Large"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-agentleak-open-source-privacy-testing-for-multi-agent-llm-systems", "markdown": "https://wpnews.pro/news/show-hn-agentleak-open-source-privacy-testing-for-multi-agent-llm-systems.md", "text": "https://wpnews.pro/news/show-hn-agentleak-open-source-privacy-testing-for-multi-agent-llm-systems.txt", "jsonld": "https://wpnews.pro/news/show-hn-agentleak-open-source-privacy-testing-for-multi-agent-llm-systems.jsonld"}}