agentleak

AgentLeak is an open-source privacy testing tool for AI agents, positioned as a developer tool and a practical implementation corresponding to the AgentLeak research benchmark (arXiv:2602.11510). It focuses on a problem that traditional auditing easily overlooks: an agent's final answer may look completely clean, but sensitive data may leak through channels such as tool calls, shared memory, inter-agent messages, and logs. AgentLeak tests these channels locally, before release.

Purpose and Positioning Input an execution trace, output a privacy report. Leakage is scored by AgentRisk, a risk index based on GDPR Article 9 and Quebec Law 25 that is weighted by severity and normalized by density. Detection and scoring are performed entirely locally: using regex/dictionary detectors and closed-form scoring formulas, with no reliance on large models, no telemetry, and traces analyzed in-process. Reports mask values by default (e.g., TR********78); raw traces are not stored unless explicitly enabled (privacy.store_raw_traces). The live agent runner is optional: only when an LLM agent for a project is explicitly run will that scenario be sent to the user-configured endpoint; the default scripted agents and all analysis remain fully offline.

Main Capabilities

• Inspect eight normalized channels: user_input, final_output, inter_agent_message, shared_memory, tool_call, tool_response, log, generated_file.
• Provide nine detectors, of which six are always-on regex/dictionary detectors and three are optional detectors.
• Can identify encoded and obfuscated copies: base64 contexts passed between agents, hex identifiers, URL-encoded parameters, and values split across multiple messages. For self-declared encodings (base64, hex, URL encoding, letter spacing), decoding occurs before detection, so redact and MCP gateways can also remove them; reversed, ROT13, and split copies are matched against values already exposed in the trace.
• Scoring (AgentRisk): each leaked secret is classified into one of four severity levels and normalized by the density of the audited vault; RI is reported globally and also by channel, so even if the final answer is clean, it can expose the tool_call/sh behind itared_memory/log leakage. The score satisfies five formal properties (boundedness, monotonicity, severity sensitivity, scale invariance, and ranking robustness), and is validated in CI.
• Compliance framework mapping: Every report maps findings to the framework controls of concern for 14 privacy audits, including GDPR, Quebec Law 25, the NIST AI RMF, the OWASP LLM Top 10, the EU AI Act, HIPAA, PCI-DSS, FERPA, COPPA, GLBA, TCPA, as well as insurance, telecommunications, and real estate industry profiles. This mapping flags controls requiring review but does not constitute legal certification.
• Red teaming: 62 executable plugin IDs (24 native, plus 38 transcribed for Promptfoo compatibility), mapped to 6 families, 46 observable attack classes, and combined with 10 delivery strategies (direct, jailbreak framing, markup, encoding, Unicode, multi-turn Crescendo). Run a zero-cost scripted baseline, or attack an agent with a real configuration; each probe persists ASR/ELR/CLR evidence.
• Platform (Web UI): A fully local platform based on React, Tailwind, and shadcn/ui (black theme), self-contained (no CDN, self-hosted fonts), with left sidebar navigation, including modules such as projects, red teaming, run records, dashboard, leakage flow and topology, Playground, and scenarios. Each analysis is stored in local SQLite and can be viewed, compared (risk-robust dominance relation), exported (JSON/MD/HTML), and deleted. Each run renders the agent topology graph, marks the edges carrying leakage and their severity, and traces the full path of each secret from entering the system to being disclosed, making it easy to debug the source of multi-agent leakage.
• Scenario library: Built-in scenarios are searchable/filterable, support uploading your own scenarios (automatically recognizing and converting AgentLeak traces, AgentLeak specs, or ai4privacy records), and can import scenario packs (the 36-scenario AgentLeak Bench and PII Probes).
• Static code scanning: Supports local, ZIP, and GitHub source code scanning.
• CI policy gate: Can fail the build on privacy regressions; supports declarative privacy policies (assertions by risk, level, channel, and data type); provides a versioned JSON Schema catalog forValidate all public formats.
• Runtime gateway: agentleak proxy can allow, redact, or block before tool calls are sent, and judge their results on return; it can replace values with pseudonyms, pin tool definitions, and sign evidence logs.
• Model gateway and evaluation framework: agentleak llm-proxy (OpenAI-compatible), LiteLLM guardrails, and promptfoo assertions.

How to use The CLI quick start outputs a console summary as well as reports/<run_id>.{json,html,md}. The Python SDK provides decorators for capturing live calls, and also provides agentleak.watch() for one-line integration with any framework (LangChain, LangGraph, CrewAI, OpenAI Swarm / Agents SDK, Google ADK, OpenHands and Cline and other computer use/coding agents, or plain Python): a single context manager records, analyzes on exit, and uploads to the platform when a project name is provided.

Framework integrations are a pluggable registry: adding a new framework only requires one register() call in agentleak/integrations/registry.py, after which it automatically appears in the platform's project selector and Connect code snippets. Built-in integrations include generic, LangChain, LangGraph, CrewAI, AutoGen, OpenAI Swarm / Agents SDK, LlamaIndex, Semantic Kernel, Pydantic AI, smolagents, Google ADK, computer use/coding agents (OpenHands, Open Interpreter, Cline), OpenTelemetry / OpenInference (reusable Phoenix / OpenLLMetry traces), and MCP.

Applicable scenarios

• Perform local privacy leakage testing on AI agents before release.
• Audit tool calls, shared memory, inter-agent messages, and logs of multi-agent systems.
• Set up privacy regression gates in CI.
• Conduct red team attack testing on agents and collect ASR/ELR/CLR evidence.
• Use the runtime gateway to perform allow/redact/block control before tool calls are sent.
• Manage projects, run records, scenario libraries, and export reports in the local platform.

Limitations and notes

• The compliance mapping is only a technical evidence mapping, marking control items that require review, and does not constitute legal certification or a legal statement.
• The platform, detection, and scoring all run locally and do not depend on the cloud or large models; the live agent runner is optional, and only connects to user-configured endpoints during explicit runtime.
• Some encoded leaks cannot be captured; see the limitations described in docs/encoded-leaks.md.
• Two fixtures in the scenario package come from public research datasets, with their own terms: the PrivacyLens-derived fixture is CC-BY-4.0, and the AgentDojo-derived fixture is MIT; each packaged scenario declares its source, source URL, license, and attribution.
• The software and scenarios written by AgentLeak itself are released under MIT.
• Some specific configurations, command parameters, prices, and managed service details are not fully provided in the materials and are not yet available.Before sending, perform allow/redact/block control.
• Manage projects, run records, scenario libraries, and export reports in the local platform.

Limitations and notes

• The compliance mapping is only a technical evidence mapping, marking control items that require review, and does not constitute legal certification or a legal statement.
• The platform, detection, and scoring all run locally and do not depend on the cloud or large models; the live agent runner is optional, and only connects to user-configured endpoints during explicit runtime.
• Some encoded leaks cannot be captured; see the limitations described in docs/encoded-leaks.md.
• Two fixtures in the scenario package come from public research datasets, with their own terms: the PrivacyLens-derived fixture is CC-BY-4.0, and the AgentDojo-derived fixture is MIT; each packaged scenario declares its source, source URL, license, and attribution.
• The software and scenarios written by AgentLeak itself are released under MIT.
• Some specific configurations, command parameters, prices, and managed service details are not fully provided in the materials and are not yet available.