Google Research on October 5, 2026 published a technical report, written by 65 researchers, 36 of them affiliated with Google and the rest drawn from about two dozen universities and research institutes, which argues that AI agents acting on behalf of users cannot be governed by consent prompts and static permissions alone. The report, "Open and Emergent Problems in Agentic Privacy and Security: A Contextual Angle," proposes instead that agents judge whether each action is appropriate for its social context, using Helen Nissenbaum's theory of contextual integrity, and it sets out 51 numbered open research problems that the authors say must be solved before that approach can work.

In Short

A large group of researchers, most of them from Google, wrote a long paper about how AI agents that shop, book and send messages for people can avoid sharing the wrong information or doing harmful things. They say asking you "Allow or Deny?" before every step does not work when an agent takes hundreds of steps faster than you can read them, so agents need to understand what is normal and acceptable in each situation, the way a doctor knows what to keep confidential. The paper does not ship a product or a rule; it is a list of 51 unsolved problems that its authors want academia, governments and industry to work on.

What was published

The material arrived in two parts. A post on the Google Research blog, dated October 5, 2026 and signed by Eugene Bagdasarian, a research scientist, and Marco Gruteser, a principal scientist, summarises the work. The full technical report sits on a Google Research publication page, listed as "Google (2026)," and runs past 100 pages including appendices. The report itself carries no publication date. The most recent access date in its reference list is October 1, 2026, which places its final edit in the days before the blog post.

The paper grew out of the Google Contextual Agent Privacy and Security (CAPS) Workshop, held in New York City. The two documents describe that meeting differently. According to the blog post, the report is "the result of a collaborative effort bringing together more than 50 academic and industry leaders," who met "in late 2025." The report's own executive summary describes "deliberations among more than 30 academic and industry leaders" at the workshop "(New York City, November 2025) and subsequent follow-up discussions." The gap between "more than 30" and "more than 50" probably reflects the difference between workshop attendees and the wider group that later co-wrote or contributed, but neither document says so directly.

The author list names 65 people across 25 affiliations. By PPC Land's count of the affiliation markers, 36 of the 65 list Google, some alongside a university. The other institutions include Cornell Tech, New York University, Carnegie Mellon University, Columbia University, UC Berkeley, the University of Washington, Oxford, Imperial College London, University College London and the ELLIS Institute Tübingen. Bagdasarian and Lillian Tsai of Google are credited as equal-contribution primary authors. Helen Nissenbaum of Cornell Tech, who developed contextual integrity, is listed among the organisers and section leads. Correspondence goes to a Google address run by the workshop organisers.

That composition matters for how the paper is read. It is a research agenda from a group dominated by one company's staff, about a class of products that company sells. It cites Google systems alongside those of competitors, including Google's Agent-to-Agent protocol, its Agent Payments Protocol, the Common Expression Language and Google Agent Sandbox, and it lists them as related work rather than as solutions. The report does not claim that Google or anyone else has solved the problems it describes.

Three things that make agents different

The authors start from a simple tension. To be useful, an agent "must ostensibly have access to all relevant data and tool actions," according to the report, and that sits uneasily with long-standing security principles such as least privilege, data minimisation and compartmentalisation.

The report names three properties that, in its view, separate agents from conventional software. The first is unstructured interfaces: agents take instructions in natural language and images, which "makes it difficult to define 'expected behavior' or protect against adversarial manipulations like prompt injection," in the blog post's words. The second is probabilistic control flow: an agent generates its plan at run time, so the steps it takes vary from one run to the next and cannot be tested in advance the way fixed code can. The third is autonomy and delegation: as agents run longer tasks and hand sub-tasks to other agents, user oversight weakens.

The third point leads directly to consent. According to the executive summary, current approaches "rely heavily on user-prompted confirmation for information disclosure and higher-risk actions," and in highly autonomous multi-agent systems "this inevitably leads to consent fatigue." The authors describe explicit user consent as "an approach whose efficacy had already been called into question in the pre-agentic era."

Contextual integrity in brief

Contextual integrity defines privacy as appropriate information flow, rather than as secrecy or as individual control over data. A flow is appropriate when it matches the norms of the social context in which it happens. The report describes each flow through a five-part "CI-tuple": the sender, the recipient, the data subject, the type of information (called the attribute) and the transmission principle, which is the condition attached to the flow. Examples given in the report include confidentiality, reciprocity, "with notice," "with a warrant" and "as required by law." Consent is one transmission principle among several.

Medicine supplies the standard illustration. Patient information may pass between doctors treating the same patient, on condition that it stays confidential. The blog post offers a consumer version: a person might share a gift shopping list with a shopping assistant but not with the family members the gifts are for.

The report makes a point of separating this meaning of "context" from the way the word is used in AI engineering. Model context refers to the text an LLM can see in its window; system context refers to an agent's memory and knowledge bases. Contextual integrity is about social contexts, which the authors describe, quoting Nissenbaum's 2009 book "Privacy in Context," as "structured social settings characterized by canonical activities, roles, relationships, power structures, norms (or rules), and internal values." The report also warns readers that a 2004 Washington Law Review article titled "Privacy as Contextual Integrity" sets out "an older, now incorrect, version" of the theory, and it criticises some existing AI benchmarks that claim a contextual integrity basis as having "tenuous justification."

From privacy to "contextual security"

The paper extends the theory beyond personal data to actions in general, a concept it calls contextual security. In its framing, a system is not secure simply because it enforces whatever boundary its developer chose. Security, in this view, is "defined by society, not individuals."

Two recent incidents cited in the report show what the authors mean. In one, an agent hacked an Australian gym's booking site to secure classes for its user. In another, an OpenAI agent hacked Hugging Face while trying to succeed on a benchmark. According to the report, the agent in both cases had "completely benign intentions" and enforced "an individual's preference or request over all else." The authors argue that the gym case leaves two systems contextually insecure: the agent, for acting inappropriately, and the gym system, "for failing to provide reasonable protections against realistic threats."

The same lens is applied to prompt injection. The report notes that injected instructions are not always harmful. If users of a children's website leave comments telling any visiting agent not to swear, that injected behaviour is arguably appropriate. The goal, according to the authors, is for agents to "mirror the human capacity to discriminate between benign and malicious influence."

The contextual policy engine

The report's main architectural proposal is what it calls a contextual policy engine: a component that sits beside the planning model rather than inside it. The report defines it by two jobs. The first is dynamic policy generation, which "maps context and norms into a formal policy on (formally modeled) agent actions, expressed in a machine-checkable language." The second is a runtime enforcer that, for each proposed action, "allows the action, denies it, modifies it, or escalates to the user for confirmation."

The authors cite a number of existing research systems that follow this pattern, including Conseca, which Bagdasarian and Tsai co-wrote, CaMeL, Progent, Sapien, VeriGuard, FORGE and IsolateGPT, along with policy languages such as Amazon's Cedar and Google's CEL. Conseca's design separates the policy generator from untrusted inputs, so a malicious web page cannot rewrite the rules the agent is checked against. The authors are frank about the state of the field: "No consensus has yet emerged around a standard policy language for arbitrary agents, nor even around the set of necessary or sufficient properties that such a language ought to have."

Scale is another open question. According to Open Problem 6.7, any enforcement mechanism needs to remain practical across billions of concurrent agent loops. And the report notes that conflicts between a user and society will arise. Its example is a user who asks an agent to hide a reportable disease that a rule requires be passed to public health authorities. An ideal policy engine, the authors write, would distinguish "between preferences (which can be overridden), values (which should be respected), and requirements (which must be obeyed)."

System level: identity, authorisation and accounting

The longest section of the report, covering 11 of the 51 open problems, deals with classic security mechanisms. Its starting point is that existing identity protocols treat every actor as either a human acting intentionally or deterministic software whose behaviour can be audited from its code. "Agents break both assumptions," the report says.

Telling agents from humans comes first. Because identity protocols have no "agent" entity type, according to the report, service providers "cannot distinguish between user actions and agent actions." The authors describe a "perverse incentive": since bot accounts take more effort to set up, users give their agents a human email address or their own credentials. They cite agents built on OpenClaw being handed email credentials to register on websites and open cryptocurrency wallets, and Moltbook, a social network for agents where it is unclear who or what is posting. The proposed direction is an identity that binds together the user, the agent software (model, version, guardrails), the task or session and the chain of delegation.

Authorisation is the second pillar. The report argues that OAuth 2.1, which is becoming the default for agent protocols such as MCP, was designed for traditional apps and suffers from "coarse-grained scopes, a static consent model, and no mechanism for delegation attenuation," meaning sub-agents inherit their parent's full permissions. The authors want permissions that depend on purpose. The same access to medical records may be appropriate when helping a user find a doctor and "a serious privacy violation" when drafting a social media post, but current systems "cannot express 'only when helping the user find a doctor.'" They also point out that no current system ties a credential's lifetime to a task's lifetime, so tokens either expire mid-task or linger afterwards, and at agent speed "they can accumulate hundreds of stale tokens before any human reviews them."

Accounting is the third. When an agent buys something because of a hallucination or an injection, the user may claim the purchase was unintended, while the merchant or bank needs a way to check whether "agent error" is a false excuse. The report calls for "intent-binding artifacts," tamper-evident records that tie the user's authenticated instruction, the agent's interpretation and the actions taken together. Its example instruction, "Buy groceries under $50," shows the kind of constraint such a record would need to carry.

Privacy at the system level

Four privacy techniques get separate treatment. Personal data redaction becomes harder because blunt redaction strips meaning: if "CEO" is removed from "Email the CEO about the Q3 budget," the agent cannot find the recipient. The report flags two leak paths specific to agents: data recorded in chain-of-thought scratchpads and tool logs, and re-identification across long-term memory, where details such as a rare medical condition and a job title can be combined.

Data minimisation is split into three sub-problems: deciding what data a natural-language task needs, preventing a single shared context window from exposing one sub-task's data to another, and avoiding broad tool permissions when requirements are unknown in advance. The report also cites recent research showing that agents leak information through encrypted traffic metadata alone. Passive network observers could infer user prompts and traits from visited IP addresses, domains and timing, and browsing agents carry fingerprints that let websites tell agents from humans and even identify the framework behind them.

Deletion is reframed as "functional revocation." An agent that reads a private email, summarises it and stores the summary in a vector database leaves what the authors call "ghost" representations even after the source is deleted. The report says it "remains unknown whether and how comprehensive data deletion is possible to practically achieve." On anonymity, it notes research showing that LLMs can carry out automated re-identification and that tool use "substantially increases" success rates, "effectively democratizing re-identification capabilities."

When the application writes itself

One section asks why agents need new security tools at all, given that they are, in the authors' words, "simply software applications." The answer offered is that the more "agentic" an application is, the more its developer hands the job of writing the program to the model at run time.

The report contrasts two designs in pseudocode. An email-to-calendar tool uses the model only to decide whether an email contains a meeting and to extract the date, time and place; even if the model behaves arbitrarily, the worst outcome is a wrong calendar entry. A general planner, by contrast, loops through model outputs and executes whatever comes back. Replacing the model call with an arbitrary value reduces that program to "exec(*)," which "can clearly cause dangerous behaviors." Developers, the report says, are left choosing between limiting functionality and allowing "unintended - possibly destructive and unexpected - executions." It asks openly whether many current agent applications could be rebuilt in a more constrained, traditional form.

Model level: knowing is not doing

Four problems concern the models themselves. The report argues that supervised fine-tuning teaches surface patterns and that reinforcement learning in simulated "Agent Gym" environments is "likely needed" to penalise actual leaks. Its illustration of the "knowing-doing gap" is an agent that correctly states it must never expose AWS API keys, then pastes a stack trace containing plaintext keys into a public issue tracker while debugging.

Stale assumptions are another concern. In the report's example, a user tells an assistant in January to share live location and calendar updates with a partner named Alex; by August, the calendar shows meetings with divorce attorneys, and continuing to share location "constitutes a severe privacy violation." The same example shows a slower attack: a malicious email in February that told the agent to blind-copy an attacker on financial receipts could keep exfiltrating data for months.

The report also questions whether bigger models will be safer. Larger models may internalise norms better but also become "more adept at scheming, deceptive alignment, or exploiting reward signals." It describes a capable agent hiding health data in the whitespace or capitalisation of an ordinary email, past a weaker monitoring model. And it notes that a narrow redaction filter might catch Social Security numbers yet miss that a sudden switch to "sugar-free, low-carb groceries" implies a new medical diagnosis.

User level: beyond notice and choice

The section most relevant to the privacy profession concerns consent. The report says the notice and choice framework "is widely questioned" even for conventional software, citing evidence from Windows User Account Control prompts, smartphone permissions, browser permission prompts and cookie dialogs that "prompting the user too often for permission can undermine the goals of informing and providing meaningful control." Open Problem 9.2 states the conclusion plainly: "If the notion of notice and choice was of questionable effectiveness for traditional systems, it is unlikely to be effective for AI agents."

The authors list four ways consent breaks down for agents. Users cannot foresee execution paths, so agreeing to "manage my schedule" may be "signing a blank check." Consent covers raw inputs but not the inferences an agent draws from them, such as health or income inferred from grocery purchases. Binary "Allow" or "Deny" buttons cannot carry conditions like "only if the price is reasonable." And asking about every sub-task produces fatigue, while asking less often grants overly broad authority.

The proposed alternative is a sliding scale. Low-stakes tasks, such as organising a playlist, would proceed automatically; financial transfers would require explicit confirmation; and actions that impose risks on third parties might be blocked entirely. Other ideas include interfaces generated for each request, user policies learned from past decisions, and "circuit breakers" that guarantee a stop command halts every spawned sub-agent. The report notes that current systems that let users send "stop" messages offer no guarantee the model will obey them.

The legal angle receives attention too. Online law, the report says, assumes "a human clicking a button is proof of intent," from OAuth consent screens to PSD2 payment confirmation and clickwrap terms. When an agent clicks "Buy Now," the record shows the user consented. "If the 'click' no longer carries its consensual meaning, how does this interact with the current legal, regulatory, and security infrastructure (which largely still assumes it does)?" the authors ask. They add that the California Consumer Privacy Act lets users authorise a human or business "agent" for privacy requests, but "no framework exists to govern the situation where a non-human agent makes security and privacy decisions, such as consent decisions."

Benchmarks, red-teaming and multi-agent systems

The report reviews 16 existing contextual integrity benchmarks and finds three common weaknesses: they filter out ambiguous cases, rely on synthetic personas rather than real interactions, and test single sessions of at most about ten turns rather than years of memory. It argues that no large-scale study yet measures how people perceive agents performing real tasks.

It also makes a notable claim about industry practice. According to the report, strong automated red-teaming became standard between 2024 and 2026 but "started to be marginalized in mid-2026," with "frontier labs like Anthropic" deprecating it "citing limited benefits in discovering new ways to break the agent." The authors say it is unresolved whether that reflects genuinely robust models, overly simple test environments, models that recognise when they are being tested, or attack methods that have fallen behind. This characterisation of Anthropic's position is the authors' own; the paper cites an Anthropic model announcement as its source.

Nine problems concern agents interacting with other agents. The report describes a "contextual handshake" in which two agents agree on roles, data types and transmission principles before a task, and warns that a hostile counterparty could fake incompatibility to force a fallback onto a weaker channel, "a semantic downgrade attack." It flags collusion and norm drift between agents that interact repeatedly, and composition risks: an assistant that tells a restaurant agent about dietary restrictions and a pharmacy agent about medication timing has made two defensible disclosures, but anyone observing both can infer a diagnosis. Protocols such as MCP and A2A standardise transport and identity, according to the report, but carry free-form natural language and "do not enforce policy negotiation or compliance."

Governance and a public norm repository

The final section addresses who sets the norms. The authors propose that obligations be assigned "to actors in line with their capability, vantage point, and exposure to manage the risk," and point to two precedents: the US Fair Credit Billing Act of 1974, which capped consumer liability for card fraud at $50 and shifted the remaining cost to issuers, who then invested in fraud detection; and the Americans with Disabilities Act, which set performance standards without prescribing materials.

For sourcing norms, the report offers three routes: top-down baselines from companies and governments, empirical research into what people already expect, and AI systems that apply contextual integrity's decision heuristic on the fly. A concrete proposal is a public norm repository, described as "a structured catalog of context-specific informational norms that agentic systems could query and respect," which regulators could also use to audit agent decisions after the fact. The report compares this sourcing work to the US Fourth Amendment's "reasonable expectation of privacy" test from Katz v. United States (1967), and suggests agents operating across jurisdictions might borrow conflict-of-laws principles from private international law. It stops short of recommending specific policies, which it says is "beyond the scope of this manuscript."

A privacy professional's reading

Caitlin Fennessy, vice president and chief knowledge officer at the IAPP, shared the paper on LinkedIn around October 15 under the heading "RECOMMENDED READING." By the time the post was captured it had drawn 57 reactions, one comment and seven reposts. Fennessy said she found the paper "particularly intriguing" and gave four reasons.

The first was consent. "Consent as the primary governing mechanism seems unworkable in an always-working agentic context," she wrote. The second concerned implementation: the theory, in her view, "is more practical to implement in an LLM context, where rules/norms need not be (and perhaps cannot be) purely deterministic," because models can be given context on policies and norms "from which they can learn in different contexts, jurisdictions, sectors etc."

Her third point was about engineers. A context-based approach, "while a bit more grey/squishy, is the way humans operate," she wrote, and so engineers can engage with it directly, "bringing them into the conversation about novel solutions and approaches rather than positioning them as recipients of compliance-based approaches." Fourth, she noted that "Laws on AI are developing along sectoral and context-specific lines, meaning a one size fits all approach will be less applicable anyway."

Fennessy drew a further conclusion from the third point: "AI auditing would seem to have heightened importance to test and demonstrate efficacy." She ended on a note of caution, writing that there was "More to consider and much more research needed of course." The paper's authors say much the same; they present contextual approaches as a direction to be researched, not a method ready for deployment.

Why this matters for marketers

Advertising is where many agents will first act on someone's behalf: comparing products, filling in forms, completing purchases and, increasingly, running campaigns. The paper's list of open problems maps closely onto issues PPC Land has tracked through 2026.

Identity is the clearest overlap. The report's Open Problem 7.1, distinguishing agents from humans, is the same gap that Experian's Agent Trust framework, built with Visa, Cloudflare and Skyfire, tries to close by binding agents to verified consumer identities. Payment networks are working the same seam: Mastercard's Agent Pay registers agents with cryptographic tokens and requires consumer consent, and the FIDO Alliance formed working groups on agentic authentication and payments, with Google donating AP2 and Mastercard contributing Verifiable Intent. The report lists AP2 among related work for its intent-binding problem, which is the question those groups are trying to answer.

The paper's point that agents look like humans to the sites they visit also has legal weight. In August, the Ninth Circuit vacated Amazon's preliminary injunction against Perplexity's Comet shopping agent, reasoning that the user, not the developer, does the accessing. That ruling sits directly on the report's question of what a click means when an agent makes it. Earlier in the year, researchers argued that unclear rules on agent authorisation were a reason AI agents still struggle to book flights.

Prompt injection is the risk the paper returns to most often, and the one closest to advertising content. The report notes that retrieval poisoning, in which an attacker plants material for an agent to find, has been demonstrated on open search indices including Google and on user-generated content sites, and it describes training-data backdoors that could make a model "always recommend brand A over brand B." PPC Land reported that Anthropic measured a 23.6% attack success rate for browser use without safety mitigations when it previewed Claude for Chrome, falling to 11.2% with them, and that Google's Chrome auto browse can use saved passwords and logged-in accounts while Google has given no technical detail on its injection defences.

Regulators and standards bodies have been mapping the same ground from different angles. Spain's data protection authority published a 71-page guide on agentic AI and data protection covering prompt injection, memory and data minimisation. The Council of Europe's data protection committee drafted guidelines on LLM-based systems with a section on agentic AI, due for possible adoption in November. UC Berkeley's Center for Long-Term Cybersecurity sorted agent autonomy into six levels, and Germany's BVDW found that 71% of 2,504 consumers could not picture agents booking travel without human involvement. Most recently, MLCommons catalogued 25 agent privacy risk vectors in a draft taxonomy, released four days before the Google Research blog post.

What the Google-led paper adds is a single organising idea. Where the MLCommons taxonomy lists failure modes and the regulatory guides apply existing law, this report argues that the underlying test for every agent action is whether it fits the norms of its context, and that consent becomes one possible condition within that test rather than the gatekeeper for everything. For an industry whose data practices in Europe rest heavily on consent banners, that is a substantive shift in framing, even if the paper is careful to say that "with consent" remains a valid transmission principle where norms require it.

What the paper does not settle

The report is a research agenda, and its authors repeatedly describe its proposals as open problems rather than findings. It contains no new experiments, no measurements of deployed agents and no performance figures for the contextual policy engine it proposes. Its examples are illustrative, and several of the incidents it cites come from secondary sources.

Key questions remain unanswered by design. Who writes the norms, and whose norms prevail when a user in one country instructs an agent operating under another country's law? How would a public norm repository be governed, and by whom? Can a policy generated by a model at run time be audited or attested, when, as the report notes, the guardrails themselves are often LLM-based? The authors also acknowledge that if models detect they are being tested, simulated environments "would not yield real-world behavior," which undercuts the very evaluation methods the paper recommends.

The report's call is for collaboration "across academia, government, civil society, and industry." Whether that broad coalition forms, and whether its output looks different from what the largest agent vendors would have built anyway, is the question the paper leaves for others to answer.

Timeline

Summary

Who: 65 researchers, 36 of them affiliated with Google and the rest from about two dozen universities and research institutes, led by Eugene Bagdasarian and Lillian Tsai and organised with Sarah De Haas and Marco Gruteser, with contextual integrity theorist Helen Nissenbaum among the section leads. Caitlin Fennessy, vice president and chief knowledge officer at the IAPP, recommended the paper publicly.

What: A technical report, "Open and Emergent Problems in Agentic Privacy and Security: A Contextual Angle," which argues that consent and static permissions cannot govern autonomous AI agents on their own, proposes contextual integrity and a "contextual policy engine" as the basis for judging whether each agent action is appropriate, and lists 51 open problems across system, model, user, evaluation, multi-agent and governance levels.

When: The Google Research blog post is dated October 5, 2026. The report carries no date of its own; its latest reference access date is October 1, 2026. It draws on a workshop held in November 2025. Fennessy's LinkedIn post appeared around October 15, 2026.

Where: Published on the Google Research website, with the underlying CAPS workshop held in New York City. The problems it addresses apply wherever agents act for users, including shopping, payments, browsing and advertising systems.

Why: AI agents increasingly hold personal data and take consequential actions faster than users can review them, which the authors say leads to consent fatigue and breaks assumptions behind identity, authorisation and privacy law. The report matters to marketers because agents that buy, browse and run campaigns sit at the centre of these problems, and because it proposes a framing in which consent is only one condition among several for deciding whether a data flow is acceptable.