Study finds capable LLM agents leak more privacy in dialogue

The researchers systematically evaluated seven open-weight models from the Qwen3 and Llama 3.1 families. They tested these models across conversation lengths of 1 and 6 turns under three different prompting conditions. The core finding is that task capability and privacy leakage are fundamentally coupled. More capable models were systematically leakier, and no model in the evaluation was able to decouple high performance from privacy risks.

The study also highlights that thinking models, which use chain-of-thought reasoning, consistently leak more information than their non-thinking counterparts. This is attributed to the extended reasoning surface created by the chain-of-thought process. Furthermore, leakage compounds with conversation length, rising up to 3x from 1 to 6 turns. The authors suggest this coupling is a structural feature of current agentic systems rather than an artifact of misconfiguration.