mlsanityData to 7 Oct 2026

CI-Work: Benchmarking Contextual Integrity in Enterprise LLM Agents

arXiv 2604.21308 ↗First posted 23 Apr 2026cs.CR cs.CLcited by 10

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Enterprise LLM agents can dramatically improve workplace productivity, but their core capability, retrieving and using internal context to act on a user's behalf, also creates new risks for sensitive information leakage. We introduce CI-Work, a Contextual Integrity (CI)-grounded benchmark that simulates enterprise workflows across five information-flow directions and evaluates whether agents can convey essential content while withholding sensitive context in dense retrieval settings. Our evaluation of frontier models reveals that privacy failures are prevalent (violation rates range from 15.8%-50.9%, with leakage reaching up to 26.7%) and uncovers a counterintuitive trade-off critical for industrial deployment: higher task utility often correlates with increased privacy violations. Moreover, the massive scale of enterprise data and potential user behavior further amplify this vulnerability. Simply increasing model size or reasoning depth fails to address the problem. We conclude that safeguarding enterprise workflows requires a paradigm shift, moving beyond model-centric scaling toward context-centric architectures.

Key facts. Cited by 10 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 21 of its 38 references that are in the map. First posted on arXiv 23 Apr 2026.

Builds on

21 of 38 references.

Closest ancestors · 3

Same direction, newest first

  1. 2025Privacy in Action: Towards Realistic Privacy Mitigation and Evaluation for LLM-Powered Agents22 Sep
  2. 2025AgentDAM: Privacy Leakage Evaluation for Autonomous Web Agents12 Mar
  3. 2023Identifying the Risks of LM Agents with an LM-Emulated Sandbox25 Sep

Other references · 18

  1. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
  2. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
  3. 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,767
  4. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
  5. 2023Self-Refine: Iterative Refinement with Self-Feedbackcited by 3,317
  6. 2023Towards Understanding Sycophancy in Language Modelscited by 988
  7. 2023Can LLMs Keep a Secret? Testing Privacy Implications of Language Models via Contextual Integrity Theorycited by 218
  8. 2024PrivacyLens: Evaluating Privacy Norm Awareness of Language Models in Actioncited by 161
  9. 2025STAIR: Improving Safety Alignment with Introspective Reasoningcited by 72
  10. 2024CRMArena: Understanding the Capacity of LLM Agents to Perform Professional CRM Tasks in Realistic Environmentscited by 69
  11. 2024WorkBench: a Benchmark Dataset for Agents in a Realistic Workplace Settingcited by 47
  12. 2024GoldCoin: Grounding Large Language Models in Privacy Laws via Contextual Integrity Theorycited by 35
6 more
  1. 2024CI-Bench: Benchmarking Contextual Integrity of AI Assistants on Synthetic Datacited by 34
  2. 2025Contextual Integrity in LLMs via Reasoning and Reinforcement Learningcited by 30
  3. 2025Benchmarking Deep Search over Heterogeneous Enterprise Datacited by 23
  4. 2025CIMemories: A Compositional Benchmark for Contextual Integrity of Persistent Memory in LLMscited by 22
  5. 2024Privacy Bias in Language Models: A Contextual Integrity-based Auditing Metriccited by 6
  6. 2025The Impact of Scaling Training Data on Adversarial Robustnesscited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 10.

10 papers.

  1. 2026GateMem: Benchmarking Memory Governance in Multi-Principal Shared-Memory Agentscited by 8
  2. 2026POLAR-Bench: A Diagnostic Benchmark for Privacy-Utility Trade-offs in LLM Agentscited by 4
  3. 2026The Authorization-Execution Gap Is a Major Safety and Security Problem in Open-World Agentscited by 2
  4. 2026PrivacyAlign: Contextual Privacy Alignment for LLM Agentscited by 2
  5. 2026PiSAs: Benchmarking Contextual Integrity in Multi-User Agentic Systemscited by 1
  6. 2026CIDER: A Dataset of Contextual Disclosure Boundaries for Privacy Preference Alignmentcited by 0
  7. 2026Inferring Hidden User Models from the Behavior of Personalized LLM Agentscited by 0
  8. 2026"Nothing to See Here'': Unintended Disclosure through Revision Traces of LLM Deliverablescited by 0
  9. 2026Can Agents Trust Their Skills? Uncovering Unsafe Chains of Trust in Skill-Based LLM Agentscited by 0
  10. 2026Deny Without Disabling: Authorization-Paired Evaluation and Control for Multi-Agent Systemscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026AgentSCOPE: Evaluating Contextual Privacy Across Agentic Workflows
  2. 2026It Takes Two: Complementary Self-Distillation for Contextual Integrity in LLMs
  3. 2026World of Workflows: A Benchmark for Bringing World Models to Enterprise Systems
  4. 2024Operationalizing Contextual Integrity in Privacy-Conscious Assistants
  5. 2026Beyond the All-in-One Agent: Benchmarking Role-Specialized Multi-Agent Collaboration in Enterprise Workflows
  6. 2026Capable but Careless: Do Computer-Use Agents Follow Contextual Integrity?
  7. 2026AgentLeak: A Benchmark for Internal-Channel Privacy Leakage in Multi-Agent LLM Systems
  8. 2026You Told Me to Do It: Measuring Instructional Text-induced Private Data Leakage in LLM Agents