AI assistants handle email and health data, sharing information step by step. They can finish a task while leaking something sensitive that was okay to access but not to pass on. Existing safeguards judge single messages, not whole chains.
A new covers thousands of realistic multi-step tasks. PrivacyFlow plans before acting: it traces data origins, models what the recipient knows, and simulates what could be inferred. Then it executes, blocks, or asks the user.
Across multiple large language models, PrivacyFlow raised the share of completed task sequences with no detected violation by 22 to 55 percentage points. The catch is that asking the user in uncertain cases shifts decision effort back to them, so designers face a safety-autonomy tradeoff.