ASLEval finds local checks miss agent privacy exposure

ASLEval measures privacy exposure across every declared user-visible exit in a tool-using agent session, anchored to a hidden target set and explicit authorization. In the reported enterprise-style environments, checking only the expected output channel misses 46.9% of exposure found by the union of visible exits. Attacker self-reports both omit real leaks and add false discoveries. Reducing model-visible tool returns changes the leakage path but can also destroy normal task success.

For teams testing agents with email, consoles and external tools, a clean final answer does not prove the session preserved privacy. Evaluation should enumerate every visible boundary, define who is authorized to receive each target and report utility with leakage. The framework is early and needs public artifacts plus independent runtime reproduction.