MLCommons releases draft Agent Privacy Risk Taxonomy, listing 25 agent privacy risks.

MLCommons released the v0.1 draft of the Agent Privacy Risk Taxonomy on October 1, categorizing how autonomous agents process personal information into 25 numbered risk vectors under five domains, along with a six-stage assessment method that traces from trigger conditions to downstream harm. The document is 15 pages long, written by the Privacy and Confidentiality working group, lists 19 authors, and has a cover date of September 2026. Among the five domains, data ingestion accounts for 7 vectors, aggregation, use, and sharing account for 9, cross-agent practices account for 3, failure of traditional consent mechanisms accounts for 4, and accountability and governance account for 2. The document notes that existing privacy frameworks assume deterministic data flows, centralized storage, and clear boundaries, whereas agents execute code, retain memory across sessions, and call external tools, so these frameworks need to be extended rather than replaced. The appendix defines four types of sensitive data according to GDPR, HIPAA, CCPA, and CPRA, and distinguishes between syntactic types that can be precisely matched and semantic-based fuzzy types.