Google Research workshop report proposes context-aware policy checks for AI agents, as a co-author's paper argues those checks have inherent limits

The report takes contextual integrity, a framework that judges information flows by sender, recipient, information type and governing norms, and applies it to the appropriateness of actions. It calls this 'contextual security.' In the proposed design, a supervisor layer holds a policy engine. The engine generates policies at runtime, including for tools the agent discovers during a task, and checks each flow before data leaves the user's workspace. Other proposed layers include sandboxing with agent identity, contextual user controls, guardrails against collusion between agents, and governance of shared norms. The report also calls for shared 'Agent Gym' sandboxes and long-running multi-agent benchmarks. It releases no code, benchmark or measurements. [1] [7] [8]

A May 2026 paper by two of the report's authors, Abdelnabi and Bagdasarian, treats prompt injections as violations of contextual integrity. It argues that an attacker can always fabricate a context in which a blocked data flow looks legitimate. That leaves defenders trading off between stopping attacks and blocking legitimate flows. In the same paper, classifiers detected context-based injections at only 0.43–0.59 AUROC, and red-teaming informed by contextual integrity reached a 96.7% attack success rate. [4]

Benchmarks show the problem the report targets. In the academic ConfAIde benchmark, GPT-4 and ChatGPT revealed private information in contexts where humans would not, 39% and 57% of the time respectively. In the PiSAs benchmark of multi-user agents, which a report co-lead co-authored, multi-agent designs leaked less than single agents. Even so, appropriateness violations ranged from more than 25% to 77% depending on configuration, and leaks spread into agents' memory stores. [9] [5]

For practitioners, the reviewed sources point toward enforcement at the execution layer rather than prompt-level or classifier defences alone. Earlier systems followed this pattern. AirGapAgent limits an agent to the user data relevant to its task. CaMeL wraps the model in a capability-based layer and solved 67% of AgentDojo tasks with provable security. A separate 33-expert agenda paper shares the report's worry that frequent confirmation prompts cause fatigue rather than real oversight, and recommends continuous auditing over one-time certification. [2] [3] [6]