A preprint published on 20 August 2026 reports that large language models can reveal secrets held in their context through apparently harmless answers, even when they refuse a direct request for the secret. The authors call the behavior inadvertent context leakage. Their central finding is not that every model or agent leaks every secret, but that refusal controls alone may not prevent information about hidden context from influencing later outputs.
The result matters for organizations that place credentials, personal data, case files, retrieved documents, or long-lived memory inside an agent's working context. If a model can encode information about that context into benign text, an attacker may not need a conventional prompt-injection success or a verbatim disclosure. Repeated observations could be enough to infer a protected fact.
What the LLM context-leakage study tested
The paper, Inadvertent Context Leakage in Language Models, is a version-one arXiv preprint by Jaiden Fairoze, Neal Mangaokar, Kamalika Chaudhuri, Sanjam Garg, and Saeed Mahloujifar. The researchers used black-box experiments across eight proprietary language models. They placed a secret in the model's context, asked unrelated questions, and tested whether statistical patterns in the resulting benign answers revealed the secret.
In controlled digit experiments, the authors report near-perfect recovery for two-digit secrets and an 82 percent exact-match rate for four-digit secrets. They also report that a classifier could infer semantic properties of hidden information from outputs that did not explicitly repeat it. In a separate reinforcement-learning experiment, an adversary reconstructed full Social Security numbers from what the paper describes as a production-style agent setting.
Those figures are claims from the authors' experiments. They do not establish a general leakage rate for production agents, and they should not be transferred to a different model, prompt, workflow, or data type without testing. The paper also reports that stronger models sometimes leaked more information in its setup, which challenges the assumption that improved reasoning will automatically improve confidentiality.
Why benign outputs change the agent-security model
Many agent controls focus on obvious bad events: a prohibited answer, a malicious tool call, or a prompt that overrides instructions. Context leakage presents a quieter problem. A permitted output may still be correlated with protected context. A sequence of low-risk responses can therefore become an information channel.
This risk is especially relevant when an agent combines user prompts with system instructions, retrieved documents, memory, tool results, and authentication material. OWASP's guidance on sensitive-information disclosure independently identifies system prompts, files, tool output, business data, and personal information as material that can be exposed through an LLM application. OWASP does not validate the new paper's experimental results, but its risk model supports the operational premise that live context is a sensitive data surface.
Organizations should therefore treat context construction as a security boundary. Maetra's guide to prompt-injection controls for AI agents explains how input isolation, tool authorization, and output controls work together. Context leakage adds a reason to minimize what reaches the model before any output is generated.
A practical response for agent owners
Security, privacy, and AI-platform teams can use seven controls to reduce exposure and produce evidence that the controls operate:
- Minimize live context. Send only the fields needed for the current decision. Do not place reusable credentials, full identity records, or unrestricted document collections in a general-purpose prompt context.
- Separate trust zones. Keep data from different users, matters, tenants, and privilege levels in distinct memory and retrieval stores. Enforce authorization before retrieval, not only after generation.
- Tokenize high-impact values. Replace secrets and direct identifiers with short-lived references where the model does not need the underlying value. Resolve the reference only inside a controlled tool.
- Constrain output and repetition. Limit unnecessary free-form responses, rate-limit probing patterns, and monitor repeated benign queries that could support statistical inference.
- Test indirect extraction. Add canary values and multi-turn inference attempts to red-team evaluations. A test should examine correlations across outputs, not only whether the model repeats a secret.
- Isolate consequential tools. Give agents short-lived, least-privilege credentials through a broker. Require deterministic authorization and human review for high-impact external actions.
- Preserve useful evidence. Record the model and policy version, context sources, authorization result, tool calls, redactions, reviewer decision, and incident response without retaining unnecessary secret content.
The evidence record should make it possible to reconstruct why data entered a context and which control allowed it. Maetra's AI audit-log guide outlines a minimum record for accountable agent decisions.
Limits and the decision to make now
This is early research, not a peer-reviewed measurement of all deployed systems. The preprint studies selected proprietary models under controlled conditions, and vendor models can change. Its digit-recovery tasks do not prove that an arbitrary production secret can be recovered at the same rate. The authors' production-style experiment is evidence from their setup, not a disclosed real-world breach.
The prudent conclusion is narrower: a successful refusal test is not sufficient evidence that confidential context cannot influence permitted outputs. Agent owners should identify workflows that place high-impact data in model context, reduce that data before generation, and test multi-turn leakage as part of deployment approval.
Maetra analysis: context minimization, privilege separation, and evidence capture should be release gates for agents that handle regulated or confidential data. Teams can use Maetra Secure to map these controls to data-exposure risks and accountable owners.