Checking only the expected output channel misses 46.9% of an agent session's real privacy exposure.

ASLEval defines privacy exposure displacement, the gap between whatever local proxy you evaluate and target-grounded exposure across a multi-step session. It pre-registers a hidden target set then measures every declared visible exit rather than one designated action or final response. Across multiple enterprise-style environments and independently implemented runtimes, the expected-outlet-only view missed 46.9% of exposure recovered by the union of visible exits, and attacker self-reports combined omissions with a high false discovery rate. Schema-aligned internal evidence usually preceded visible exposure, giving an early-warning signal.