内容来源：https://research.google/blog/open-and-emergent-problems-in-agentic-privacy-and-security-a-contextual-angle/

内容总结：

谷歌研究团队近日发布了一份关于人工智能代理隐私与安全的重要报告。报告指出，随着人工智能代理日益自主化和通用化，如何确保其在复杂情境中行为得当，已成为亟待解决的核心挑战。

该报告源于2025年底在纽约举办的谷歌情境代理隐私与安全研讨会，汇集了来自学术界和产业界的50余位领军人物。报告以“情境完整性”理论为基础，将隐私重新定义为“符合社会规范的信息适当流动”，并进一步将这一理论从信息共享扩展到代理行为的安全性与适当性评估。

报告指出，与传统确定性软件不同，人工智能代理具有行为灵活性和跨情境行动能力，因此需要全新的隐私与安全防护思路。研究团队主张构建“情境策略引擎”，作为监督层的一部分，实时生成并执行与用户请求和动态情境相匹配的策略，在信息离开用户工作空间之前评估数据流动是否适当。

报告还呼吁在系统、模型和用户三个层面协同推进创新，并提出了建立标准化多代理基准测试环境“代理训练场”的建议，以便在安全沙箱中模拟复杂的长期交互。报告强调，构建安全、可信的代理生态系统需要学术界、政府、民间社会和产业界的广泛协作，是一份面向更广泛研究社区的行动号召。

中文翻译：

2026年10月5日
尤金·巴格达萨里安，研究科学家；马可·格鲁特瑟，首席科学家，谷歌研究院

要让AI智能体真正发挥作用，它们必须理解并受情境行为规范的约束，以确保其行为得当。受情境完整性理论的启发，我们这份新的研讨会报告勾勒出跨系统层、模型层和用户层的关键开放研究方向，旨在构建用户可信赖的AI智能体。

我们正快速迈入一个以高度通用化、日益自主化的智能体为特征的计算时代。在大语言模型（LLM）的驱动下——这些模型能够动态生成计划并调用外部工具——这些系统有望让AI无缝地代我们处理复杂的多步骤任务。然而，要将这一潜力变为现实，必须解决一个关键挑战：在赋予智能体能力的同时，确保其行为得当。

今天，我们分享一份全面的新研讨会报告——《智能体隐私与安全中的开放与涌现问题：情境视角》。这份报告是50多位来自众多机构的学术界和产业界领袖通力合作的成果。我们相聚于2025年底在纽约市举办的谷歌情境智能体隐私与安全（CAPS）研讨会。在这份报告中，你将看到当今自主智能体所面临的基础性隐私与安全挑战的详细拆解，这些挑战需要在系统层、模型层、用户层和生态层进行协同防御。

智能体AI的核心挑战在于：一个智能体要有用，可能需要访问个人数据，并具备在广泛情境中采取有后果行动的能力。然而，这种访问权限加上智能体的行为灵活性，要求我们采用与传统软件截然不同的方法。与传统确定性软件不同，智能体在三个关键维度上存在差异，由此产生了研究界必须共同应对的挑战：

鉴于有用的智能体可能需要共享数据并完成任务，我们相信，可信智能体的未来取决于其能否对其所处具体情境中的社会规范和行动适当性进行推理、理解并受其约束。

但我们要如何教一个智能体理解“情境”和适当性？我们的报告以情境完整性（CI）理论为基础。该理论将隐私不仅仅定义为保密或控制，而是根据既定的、可正当化的社会规范所定义的“适当的信息流动”。一个情境特定的信息规范由其参与者（谁在发送和接收关于谁的信息）、信息类型（具体的信息类别，如医疗或财务记录）和传输原则（管理流动的规则，如保密性或互惠性）所界定。例如，你可能愿意与虚拟购物助手分享你的礼物购物清单，但不愿与家人和朋友分享。我们的报告将情境完整性从信息共享扩展并推广到情境安全，即智能体行动的适当性。通过将智能体隐私与安全锚定在情境完整性中，我们探索如何设计系统，使其在执行行动之前评估该行动在社会和情境上是否适当。

自情境完整性理论创立以来，大语言模型首次提供了一个机会，让我们能够创建真正依赖情境的机器可读策略。长期以来，高层情境规范与底层系统权限之间一直存在语义鸿沟。例如，“在帮我安排会议差旅时保护我的数据”需要具体指令来说明：在预订航班、申请签证和与组织者沟通时，哪些用户信息适合分享。

传统方法如手动权限设置或专家编写的策略，无法扩展到AI智能体自主执行多个复杂、长时间运行任务的未来。随着语言模型开始理解情境完整性，我们认为这一鸿沟可以被弥合。我们的报告倡导在模型和用户交互方面的进展之外，辅以一个情境策略引擎，作为监督层的一部分来监控和强制执行行动的适当性。该策略引擎包含一个动态策略生成循环，能够实时运行（如下图所示），根据用户请求和开放式的动态情境（包括运行时可能发现的新工具和能力）来定制策略。这使得系统能够在任何信息离开用户工作空间之前，评估所请求的数据流动是否适当。

朝着情境策略引擎努力，结合模型层和用户层的必要进展，形成了一种多层方法。我们的报告概述了全栈创新的机会：

最后，我们提出开发新的安全评估方法，使其更直接地适用于高度自主的多智能体系统。我们的报告强调需要标准化的多智能体基准测试——动态的“智能体训练场”环境，研究人员可以在其中安全地模拟长时间内的复杂级联交互。借助这些开源沙盒，我们可以在学术界和产业界之间建立稳健的、共享的隐私、安全和安保基线。

这是一个雄心勃勃的项目，但一个安全、可靠、可信的智能体生态系统对于任何单一学科、组织或部门来说都太过庞大。报告呼吁新思想和新形式的合作，列出了基础性机遇；它是对更广泛研究界——横跨学术界、政府、公民社会和产业界——的行动号召，呼吁大家共同开发必要的情境基础设施，以支撑一个安全、可靠、尊重隐私的生态系统。我们邀请你阅读这份技术报告。

我们要感谢蔡丽莲担任共同第一作者，感谢莎拉·德哈斯协调研讨会、报告撰写和博客文章。卡塞姆·法瓦兹、斯特凡·梅勒姆、海伦·尼森鲍姆和妮娜·塔夫特参与了概念构建、多章节撰写并指导了写作过程。塞巴斯蒂安·本索尔、马迪哈·扎赫拉·乔克西、塞利姆·埃尔-赛义德、费尔迪南多·菲奥雷托、阿德里亚·加斯孔、阿什什·胡达、伊万·彼得罗夫、弗朗切斯科·平托、奥克塔维安·苏丘、特里希塔·蒂瓦里、哈罗德·特里德曼、任毅和张文担任各章节负责人。我们感谢50多位共同撰写报告或参与研讨会讨论的研究人员、学术伙伴和产业领袖所做出的贡献。这项工作得到了丹尼尔·拉马奇、科琳娜·科尔特斯、约西·马蒂亚斯、普什米特·科利、汉克·利维、拉卢卡·阿达·波帕、阿曼达·沃克、布伦丹·麦克马汉和詹姆斯·马尼卡的支持。

英文来源：

October 5, 2026
Eugene Bagdasarian, Research Scientist, and Marco Gruteser, Principal Scientist, Google Research
To be useful, AI agents must understand and be constrained by contextual behavioral norms to ensure they act appropriately. Inspired by the theory of Contextual Integrity, our new workshop report outlines key open research directions across system, model, and user levels to build AI agents users can trust.
We're rapidly transitioning to a computing landscape defined by highly general, increasingly autonomous agents. Driven by large language models (LLMs) that can dynamically generate plans and invoke external tools, these systems offer the potential for AI to seamlessly handle complex, multi-step tasks on our behalf. However, realizing this potential requires solving a key challenge: enabling agent capability while ensuring that agents act appropriately.
Today, we share a comprehensive new workshop report, "Open and Emergent Problems in Agentic Privacy and Security: A Contextual Angle," the result of a collaborative effort bringing together more than 50 academic and industry leaders from numerous institutions. We met at the Google Contextual Agent Privacy and Security (CAPS) Workshop, held in late 2025 in New York City. In this report, you’ll find a breakdown of foundational privacy and security challenges that autonomous agents face today, needing coordinated defenses at the system, model, user, and ecosystem levels.
The core challenge of agentic AI is that, for an agent to be useful, it may need to have access to personal data and the ability to take consequential actions across a broad range of contexts. However, this access together with agents’ behavioral flexibility requires meaningfully different approaches from those used in traditional software. Unlike traditional deterministic software, agents differ in three critical dimensions that lead to challenges the research community must address together:
Given that useful agents may need to share data and complete tasks, we believe that the future of trustworthy agents depends on their ability to reason about, understand, and be constrained by the social norms and appropriateness of their actions— for the specific context in which they operate.
But how do we teach an agent to understand "context" and appropriateness? Our report is grounded in the theory of Contextual Integrity (CI), which defines privacy not just as secrecy or control, but as "appropriate information flow" according to established and justifiable social norms. A context-specific informational norm is defined by its actors (who is sending and receiving information about whom), the types of information (specific categories of information, like medical or financial records), and transmission principles (the rules governing the flow, like confidentiality or reciprocity). For example, you might be willing to share your gift shopping list with a virtual shopping assistant, but not your family and friends. Our report extends and generalizes contextual integrity for information sharing to contextual security, that is the appropriateness of agent actions. By anchoring agent privacy and security in CI, we explore how we can design systems that evaluate whether an action is socially and contextually appropriate before executing it.
For the first time since the development of the theory of Contextual Integrity, LLMs provide an opportunity to create machine readable policy that is truly context dependent. There has historically been a semantic gap between high-level contextual norms and low-level system permissions. For example, “protect my data while organizing my travel for a conference” requires specific instructions on what user information is appropriate to share when booking flights, applying for visas, and communicating with organizers.
Traditional methods like manual permissions or expert-written policies cannot scale to a future with AI agents autonomously performing multiple complex, long-running tasks. As language models begin to understand CI, we argue that this gap can be bridged. Our report advocates for complementing model and user interaction advances with a contextual policy engine that forms part of a supervisor layer to monitor and enforce the appropriateness of actions. This policy engine includes a dynamic policy generation loop that can operate in real time (illustrated below) to tailor policies to the user request and open-ended, dynamic contexts, including new tools and capabilities that might be discovered at runtime. This allows the system to evaluate whether a requested data flow is appropriate before any information leaves the user's workspace.
Working towards contextual policy engines together with necessary advances at the model- and user-level results in a multi-layered approach. Our report outlines opportunities for innovation across the entire stack:
Finally, we propose the development of new approaches to safety evaluations that more directly apply to highly autonomous, multi-agent systems. Our report highlights the need for standardized, multi-agent benchmarks — dynamic "Agent Gym" environments where researchers can safely simulate complex, cascading interactions during extended periods. With these open-source sandboxes, we can establish a robust, shared privacy, security, and safety baseline across academia and industry.
This is an ambitious project, but a safe, secure, and trustworthy agentic ecosystem is too large a task for any single discipline, organization or sector. Calling for new ideas and unprecedented collaborations, the report lays out foundational opportunities; it is a call to action for the broader research community across academia, government, civil society, and industry to develop the contextual foundations necessary for a safe, secure, and privacy-respecting ecosystem. We invite you to read the technical report.
We would like to thank Lillian Tsai for serving as co-primary author and Sarah de Haas for coordinating the workshop, report writing, and blogpost. Kassem Fawaz, Stefan Mellem, Helen Nissenbaum, and Nina Taft contributed to conceptualization, writing across multiple sections, and guided the writing process. Sebastian Benthall, Madiha Zahrah Choksi, Seliem El-Sayed, Ferdinando Fioretto, Adrià Gascón, Ashish Hooda, Ivan Petrov, Francesco Pinto, Octavian Suciu, Trishita Tiwari, Harold Triedman, Ren Yi, and Wen Zhang served as section leads. We are grateful for the contribution by the over 50 researchers, academic partners, and industry leaders who co-authored the report or participated in workshop discussions. This work was supported by Daniel Ramage, Corinna Cortes, Yossi Matias, Pushmeet Kohli, Hank Levy, Raluca Ada Popa, Amanda Walker, Brendan McMahan, and James Manyika.