Google Releases Report on 51 AI Agent Security Issues

On October 5, 2026, Google Research released a 116-page workshop report titled 'Open and Emergent Problems in Agentic Privacy and Security: A Contextual Angle' regarding the privacy and security of AI agents. This report summarizes discussions from the CAPS workshop held in New York in November 2025, with participation from 66 researchers, including Helen Nissenbaum.

Core Perspective: Contextual Security

The report defines AI agent security issues as problems of 'appropriate action in context.' It proposes the concept of Contextual Security, extending Helen Nissenbaum's Contextual Integrity (CI) theory to the security domain, and emphasizes that solutions must be multi-layered defenses at the system, model, and user levels rather than single techniques.

Key Threats and Challenges

What distinguishes agent security from traditional software is the ambiguity of natural language inputs, probabilistic control flows, and the difficulty of oversight due to autonomy. The report presents four threat models: malicious users, environment, model, and non-adversarial risks. It specifically proposes the Contextual Policy Engine as a core design pattern to prepare for attacks such as indirect prompt injection.

51 Open Problems

The report identifies a total of 51 Open Problems across 8 chapters. Key challenges include:

• System Level: Lack of agent authentication, limitations of static consent, gap between intent and action, and difficulties in data minimization and functional revocation.
• Model Level: Limitations in learning contextual reasoning, handling ambiguous instructions, persistence of outdated assumptions, and the risk of improved strategic capabilities with increasing model scale.
• User Level: Inadequacy of Notice and Choice, warning fatigue, and reliability issues with stop/rollback mechanisms.
• Evaluation and Governance: Limitations of existing benchmarks, the need for contextual handshakes between multi-agents, and the absence of legal/social frameworks for norm setting.

Practical Implications

While this report does not release new models or benchmark scores, it recommends that developers shift the unit of privacy judgment from 'sensitivity' to 'information flow based on recipients and conditions.' It also proposes an architecture that structurally separates the policy generation module and the planning model to ensure that untrusted inputs do not influence policy generation.