Your AI Agent Is Leaking: 65% Privacy Risk Is Not a Drill

You shipped an agent that reads email, calls APIs, and acts autonomously. Congratulations — you also shipped an attack surface that standard evals never touched. A new framework just ran the red-team gauntlet on CrewAI and AutoGen, and the numbers are ugly enough to warrant a board-level conversation.

What happened

Researchers built a black-box red-teaming framework called SAGE-RT specifically targeting agentic AI systems — the kind that chain tool calls, hold memory, and act across sessions — rather than simple chat interfaces. Using only a basic system description (no internal access required), they generated 120 adversarial scenarios across each of seven risk domains and evaluated results with LLM-as-judge methodology validated by humans. They ran this against two popular multi-agent orchestration frameworks — CrewAI and AutoGen — with four different base models underneath. The headline numbers: 56.25% average governance risk, 65% privacy risk in multi-agent configurations specifically, and agent behavior vulnerabilities hitting 85%. The point of failure is architectural, not model-specific — which means swapping your LLM backbone won’t save you.

Cold read

Four base models across two frameworks is a thin empirical slice; we don’t know which models, which versions, or how they were prompted — details that matter enormously when prompt injection vs. jailbreak dynamics vary wildly by system prompt construction. The LLM-as-judge evaluation method is itself contested — a judge model can be gamed, can share failure modes with the model under test, and has known consistency issues at scale; human validation here is described but not quantified. “120 adversarial scenarios per domain” sounds systematic but tells us nothing about coverage: adversarial scenario spaces are effectively unbounded, so pass/fail rates are sensitive to how the taxonomy was built and whether it was built to find failures. Most critically, the 85% behavior vulnerability figure comes without a denominator we can trust — we don’t know the false-positive rate or whether “vulnerability” maps to exploitable real-world harm or just anomalous output. This is a research scaffold, not a production audit.

What it means for you

• Signal maturity: 2/5 — Taxonomy and tooling are early-stage; empirical validation is narrow
• Who gets hurt: Any founder shipping a vertical AI agent with real-world tool permissions — CRM writes, email sends, code execution, payments
• What breaks if this is true: Your enterprise sales motion breaks the moment a security-conscious buyer runs even a cursory red-team and surfaces a 65% privacy-risk finding; SOC 2 doesn’t cover agentic attack surfaces yet, and procurement will start asking
• Why it might not land: Most agentic deployments today still run in sandboxed or human-in-the-loop configurations where catastrophic autonomous action is blocked upstream — the real-world blast radius is smaller than the lab numbers suggest
• Watch for: Insurance underwriters or enterprise procurement teams adding explicit agentic red-team attestation requirements to vendor questionnaires — that’s the forcing function that turns this research into a compliance checkbox

Forecast as of 2026-09-10

By Q3 2027, at least one major enterprise software vendor (>$1B ARR) will publicly disclose a security incident attributable to an agentic AI system with autonomous tool permissions — and this paper’s taxonomy will be cited in the post-mortem or regulatory response. If no such disclosure occurs, the threat model is overstated for current deployment patterns.

Source: Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery — Divyanshu Kumar, Nitin Aravind Birur, Tanay Baswa, Sahil Agarwal, Prashanth Harshangi. https://arxiv.org/abs/2609.09647v1