ToolMinimize measures that 81-88% of agent tool calls leak privacy data the tool never needed, then rewrites the arguments

arXiv·high signalXBlueskyLinkedInCopy link

arXiv 2608.24957 (25 Aug) measured GPT-4o, Claude 3.5 Sonnet and Llama-3.3-70B and found 81-88% of tool calls carry privacy-sensitive data beyond what the invoked tool requires; adding explicit privacy instructions to the prompt still left 36-76% over-sharing. Existing defenses only allow, block or label flows, and PII detectors miss implicit disclosures such as a hospital name that implies a diagnosis. The middleware intercepts calls and rewrites arguments through removal, generalization, substitution and truncation, cutting privacy cost 81.2-92.0% at 100% argument-level task validity, and 79.0% on 25 unannotated MCP schemas with no `minimum_necessary` metadata.