Three privacy attacks on personal AI agents that use no prompt injection at all.

When privacy enforcement is a judgment the backend LLM makes over the same conversational context an adversary controls, the enforcement mechanism and the attack surface are the same thing (arXiv 2609.14003). Collaborative Workspace Lure reframes extraction as collaborative work. Semantic Obfuscation induces disclosure through omission rather than through anything the agent writes. Channel Decoupling splits the request and the disclosure across independent channels. The proposed fix moves confidentiality enforcement into a tool-level interceptor outside the LLM's judgment loop.