Google Proposes a System That Weighs Context Before an AI Sends Your Data

Google published a research report on October 5 (local time) dealing with the privacy and security of AI agents, systems that carry out tasks on their own. Its central argument: instead of merely checking whether an AI has permission to view a piece of information, we should make it weigh whether this is an appropriate situation in which to send that information out. The report grew out of a workshop held in New York in late 2025. More than 50 people from academia and industry contributed to the writing or the discussions.

Is having permission enough?

For an AI to handle complex work on a user’s behalf, it may need to read personal information and even take actions with real-world consequences. Google’s researchers explain that because language models now plan on their own and reach for external tools, they require a different kind of protection than conventional software. Access to and use of information, in other words, has to be constrained in a way that matches an agent’s ability to adapt flexibly to each situation.

The yardstick the report puts forward is “contextual integrity.” Rather than treating privacy purely as a matter of secrecy or control, this theory also asks whether information is flowing in a way that fits the context. It weighs whose information is going to whom, what kind of information it is, and whether rules such as confidentiality apply. The report offers the example of a gift shopping list. You might be willing to share it with a shopping assistant AI, yet not want family or friends to see it.

If you hand over your trip planning, how much can the AI reveal?

Turning that yardstick into concrete operating rules remains an open research problem. A request like “plan my conference trip while protecting my personal information” is not enough to pin down specific behaviors. For each step, booking flights, applying for a visa, corresponding with the event organizers, you have to spell out exactly what information may be passed along. The researchers describe this as the gap between people’s vague requests and a system’s fine-grained permissions.

Image: research.google

Google’s researchers propose placing a “context-based policy engine” inside the oversight layer that monitors and constrains an agent’s actions. The idea is to generate rules that match the user’s request and the circumstances of the task, then adjust those rules as the agent encounters new tools or capabilities. The goal is to evaluate whether a transfer is appropriate before information leaves the user’s workspace.

The report notes that relying solely on a human approving each permission, or on experts hand-writing every rule, will not scale. It has in mind a world where AI takes on multiple complex tasks over long stretches of time. The researchers propose multiple layers of protection that combine the oversight layer with improvements to the model’s own comprehension and the way it communicates with users.

How do you test situations where several AIs work together?

The report also proposes adapting safety testing to environments in which several AI agents operate together. It presents a testing environment called “Agent Gym” as a research direction: a way to safely reproduce long-running exchanges among multiple agents, where one action shapes the next. The researchers say that an open-source test space of this kind would let academia and industry establish shared privacy and security benchmarks.

Image: research.google

The more work we delegate to AI, the more we have to decide, task by task, how far information may be shared. This report frames the problem of judging that boundary in context and checking it before acting as a research agenda. The open questions are how accurately such rules can be applied in real products, and whether they can hold up when multiple agents work side by side.