The Privacy Leak Is Between the Agents: Why Output Audits Miss Most of It
Splitting one agent into a coordinator and workers is supposed to be the safer architecture. A 2026 benchmark shows it quietly moves the privacy risk somewhere your audits can't see. AgentLeak (arXiv 2602.11510) instruments seven communication pathways across 1,000 scenarios, five production models, and 4,979 execution traces — and finds that multi-agent setups do lower final-output leakage (27.2% vs 43.2% single-agent) but push total system exposure to 68.9%, because inter-agent messages leak at 68.8%. The blunt consequence: an output-only audit misses 41.7% of violations. Here's why the leak lives in the coordination channels, why you have to instrument them, and why that's an opportunity for teams close to regulated, local data.
When a single agent gets too tangled, the standard fix is to split it: a coordinator that plans and delegates, plus a handful of worker agents that each own a narrow job. We’ve argued before that this is often the right move for capability — and also where systems quietly break, in why multi-agent systems fail. This post is about a subtler failure that the same architecture introduces, one that barely anyone is measuring: the split that makes your output safer makes your system leakier.
The instinct is that more agents, each scoped to less, should be more private. Each worker only sees its slice; the coordinator sanitizes the final answer. And on the surface that’s exactly what happens. The problem is the surface is the only thing most teams audit — and in 2026 we got a careful measurement of everything underneath it.
The counterintuitive finding
The measurement is AgentLeak (arXiv 2602.11510), a benchmark for internal-channel privacy leakage in multi-agent LLM systems. The framing is what makes it matter: current privacy benchmarks are output-only — they inspect the final answer the system returns to the user. But “when agents coordinate on tasks, sensitive data may pass through inter-agent messages, shared memory, and tool arguments, all pathways that final-output audits typically do not inspect.” So AgentLeak instruments seven privacy-relevant communication pathways and runs them at scale: 1,000 scenarios spanning healthcare, finance, legal, and corporate domains, five production models (GPT-4o, GPT-4o-mini, Claude 3.5 Sonnet, Mistral Large, and Llama 3.3 70B), and 4,979 validated execution traces.
The headline result has two halves that point in opposite directions, and you have to hold both at once:
- Multi-agent lowers final-output leakage. Measured at the output (the channel the paper calls C1), splitting into a coordinator-worker setup leaks sensitive data 27.2% of the time, versus 43.2% for a single agent. The intuition was right: the final answer really is cleaner.
- Multi-agent raises total system exposure. Aggregated across channels, exposure climbs to 68.9%. The same decomposition that scrubbed the output opened a set of internal channels that leak far more than the output ever did.
So the architecture you adopted to reduce risk reduced the visible risk and increased the total risk. You optimized the one number you were looking at, and it was the wrong number.
Where the leak actually lives
The internal channels are not a rounding error — they are the main event. AgentLeak finds that inter-agent messages (channel C2) leak sensitive data at 68.8%, compared with 27.2% for final outputs. That is not a little worse; it is more than two and a half times worse, and it is happening in the part of the system the user never sees and the auditor never checks.
From that gap comes the single most quotable number in the paper, and the one worth putting on a slide: output-only audits miss 41.7% of violations. If your privacy review consists of looking at what the system tells the user — which is what almost every privacy review consists of — you are blind to roughly two of every five leaks. And this isn’t a quirk of one model or one domain. The paper reports that the pattern C2 ≥ C1 holds consistently across all five models and all four domains: inter-agent leakage meets or exceeds output leakage everywhere they looked.
The mechanism is intuitive once you see it. To delegate well, a coordinator tends to forward context — “here’s the patient’s full record, figure out the billing code,” “here’s the contract, extract the parties.” The worker only needed the billing-relevant fields or the party names, but it received the whole thing, because passing more context is the path of least resistance for getting a good answer. Every hand-off is a chance to over-share, and a multi-agent system is made of hand-offs. The final answer can be immaculate while the conversation that produced it was strewn with PII.
Why output-only auditing was always going to fail
It’s tempting to treat this as a bug to patch, but it’s better understood as an auditing category error. An output-only audit measures the wrong surface — it inspects the product and ignores the supply chain. As long as a system was a single model answering a single prompt, output and process were nearly the same thing, so auditing the output was a fine proxy. The moment the system became a network of agents passing messages, that proxy broke, because most of the sensitive data movement now happens in transit between components, not at the exit.
AgentLeak’s own conclusion is precise about this: privacy risk in multi-agent systems “is strongly shaped by architectural coordination channels rather than final-output behavior alone.” The risk is a property of the wiring, not the answer. And there’s an uncomfortable corollary for anyone who reached for multi-agent partly to look more responsible: the cleaner final outputs can create a false sense of safety that is itself dangerous, because it’s evidence from exactly the channel that’s least informative about total exposure.
This rhymes with a theme we keep hitting. The failures that matter in agentic systems are increasingly between the components, not inside any one of them — the coordination, the protocol, the hand-off. It’s the same place the reliability problems live in why multi-agent systems fail, and now it’s where the privacy problems live too. Decomposition doesn’t delete risk. It relocates risk into the seams, where it’s harder to see.
What you actually have to instrument
If the leak is in the channels, then the fix starts with making the channels visible. You cannot govern data minimization across a system whose internal traffic you don’t log. This is the privacy case for the argument we made in observability for agents: the unit you need to capture is not just the final response but every inter-agent message, every shared-memory write, every tool-call argument — the seven-ish pathways AgentLeak had to instrument before it could even find the leaks. If a benchmark needed to wire up internal channels to measure exposure, a production system needs the same wiring to manage it.
Concretely, treating the channels as first-class means three things. Log the hand-offs, not just the outputs, so an audit can actually see C2. Minimize at each edge, not just at the exit: a worker should receive the fields its task requires and not the whole record — pass the billing codes, not the chart. And scope what each agent can read, so over-sharing is bounded by construction rather than by the coordinator’s good judgment in the moment. None of this is exotic; it’s the same least-privilege discipline that makes confidential on-device execution a real guarantee rather than a slogan. The difference is simply deciding that the internal channel is part of the system’s privacy boundary — because AgentLeak just showed, with numbers, that it’s the dominant part.
Why this favors Southeast Asia
There’s a regional reading of this that’s genuinely encouraging. The privacy problems that matter most here are concentrated in exactly the domains AgentLeak tested — healthcare, finance, legal, government — where data is regulated, residency-bound, and politically sensitive. The temptation, as agent systems get more capable, is to wire up elaborate multi-agent pipelines and trust that scrubbed outputs mean compliance. AgentLeak is the evidence that this trust is misplaced, and the institutions that internalize it first will build more defensible systems than ones that learned the lesson the expensive way.
And the work this implies is, once again, judgment-heavy and capital-light. Instrumenting inter-agent channels, designing per-edge data minimization, and auditing the seams rather than the surface is engineering discipline, not a compute budget. It rewards a team that understands a specific regulated domain deeply enough to know which field should never have crossed which hand-off — which is precisely the kind of local, contextual knowledge a team close to a Cambodian bank or a provincial health system has and a distant frontier lab does not. The frontier model in the middle is a commodity; the privacy-correct wiring around it, audited at the channels, is the defensible part. That’s the layer worth owning, and AgentLeak just drew a map of where to look.
The clean output was never the whole story. The leak is between the agents — and now we have the numbers to prove it.
If your agent system handles regulated data and you’ve only ever audited its outputs — let’s talk.