Summary
- MLCommons has released version 0.1 of its Agent Privacy Risk Taxonomy for public feedback.
- The framework groups agent privacy risks into five areas spanning data handling, consent, interoperability, and governance.
- MLCommons plans to develop indicators and pilot benchmarks, with work continuing into early 2027.
As artificial intelligence systems move from answering prompts to acting across software, data, and external services, MLCommons has published a draft taxonomy intended to describe privacy risks created by greater agent autonomy.
Version 0.1 of the Agent Privacy Risk Taxonomy is open for public feedback and forms part of work by the organisation’s Privacy and Confidentiality Working Group, which plans to develop measurable indicators and pilot benchmarks from the framework.
The taxonomy groups risks into five areas covering data ingestion and processing; aggregation, use, and sharing; inconsistent privacy practices between interacting agents; limitations of static consent during runtime behaviour; and accountability and governance.
Those categories reflect the way agents differ from conventional chatbots, since software that retains memory, invokes external tools, interacts with other systems, and acts without requesting approval at every step can create data flows that extend well beyond the original prompt.
Agents can move data beyond its original context
When an agent combines information collected across different tasks or sources, apparently ordinary records can become more sensitive through aggregation even if no single piece of data seemed particularly revealing in isolation.
External tools add another boundary because information may be passed to services or other agents operating under different policies. A request to delete information in the original system may therefore fail to propagate automatically to every downstream component that received it.
Consent becomes harder to model in the same environment, since asking a person to approve every intermediate action may make an agent impractical to use, while granting broad permission at the beginning can leave the user unable to anticipate later decisions about their data.
Where several models, tools, agents, and organisations contribute to one task, accountability can also become difficult to reconstruct. The logs needed to explain what happened may themselves contain sensitive information, creating another privacy consideration around the evidence required for oversight.
MLCommons plans to separate risks that can be tested before deployment from governance questions that need organisational controls, while indicators and benchmark work are expected to continue through the first quarter of 2027.
The taxonomy has no regulatory authority and creates no new obligations under European privacy law. Its role is narrower: establishing terminology and potential measurements for agent behaviour so that researchers and organisations can assess risks that conventional software privacy frameworks may describe only indirectly.
With version 0.1 explicitly open to revision, MLCommons is inviting feedback from industry, academia, civil society, and regulators before the taxonomy and associated measurement work progress further.
