AI agents' tool-use logs can give away facts about the people using them

What the researchers set out to test

When an AI agent does real work, it does not only produce text. It calls outside tools: it searches, opens files, checks a calendar. A common standard for this is the Model Context Protocol, or MCP, which lets an agent plug into many different tools in a uniform way. Each call leaves a record, which the paper calls a tool-call trace.

As arxiv.org shows in a new preprint (an early paper shared publicly before peer review), the authors ask a pointed question. If an observer sees only those traces, and never sees the user's conversation, how much can they work out about the person?

The authors call this risk user-profile inference. The observer looks at interactions that are perfectly valid under the protocol, nothing hacked or malformed, and tries to infer attributes of the user from them.

How the test was built

To measure this, the team built a benchmark called PrivacyTrace. It contains 1,000 synthetic user profiles, meaning invented people rather than real ones, and 4,000 agent trajectories, which are the step-by-step runs of an agent doing tasks for those people. The runs span four domains and were produced with real MCP tools drawn from 25 servers.

Using invented profiles matters. It lets researchers know the ground truth about each person, so they can check whether an attacker's guess is right without exposing anyone's actual data.

The attackers were four mainstream large language models, the same kind of AI that powers chatbots. Each was given traces and asked to infer the profile behind them.

What they found

The attackers reached a 26.25% attack success rate for profile inference. A baseline that guesses from prior expectations, without using the trace evidence, reached 17.97%. So the traces did give the attackers a real edge, though the headline figure is far from certainty.

The paper also looked at where the revealing information comes from. The main trace-grounded evidence was in the tool arguments, meaning what the agent sent to the tool, and in the returned results, meaning what the tool sent back. In plain terms, the content of a search or a lookup says more than the fact that a tool was used.

A second finding concerns time. Linking traces across separate sessions further amplified the profiling risk. One session may reveal little, but several sessions tied to the same person can add up.

From this, the authors conclude that tool-call traces can work as behavioral side channels. That is a security term for information leaking through a by-product of a system rather than through the data it was meant to protect.

Who should pay attention

The paper's findings point to the agent builders first. The authors say the results motivate privacy-aware mechanisms for how agents and tools interact, which implies today's designs do not have them built in. Teams that wire agents to many tools may want to think about what each call exposes, and to whom.

Everyday users are affected too, because traces can end up in several places. Our own reading, not the paper's: a tool provider, a plugin or your employer could each hold logs of what your agent did. The paper does not say who holds traces in practice, so treat that as a question to ask rather than a finding.

It is worth keeping the limits in view. The profiles were synthetic, the success rate was modest, and the work is a preprint that has not yet been through peer review. It shows that the risk exists and can be measured. It does not show how much leaks in any particular real-world setup.

Sensible habits in the meantime

You do not need to stop using agents. A few habits follow from the paper's emphasis on arguments and results:

• Check which tools your agent is connected to, and read what each one logs.
• Keep personal details out of tool inputs when you can.
• Prefer connections you can switch off when a task is done.

For builders, the finding suggests treating traces as sensitive data in their own right, with the same care as conversation text. The authors have released code and data, so others can test their own agent setups against the same benchmark.