People reviewing an AI assistant's draft replies for privacy leaks fell into six behavior patterns — and only one actually caught the leaks.

This explores what happens when people act as the privacy check on an AI agent's replies, and what the six oversight patterns researchers found say about whether that check works. First, a limit: the collection records that a cluster analysis found six distinct patterns, but it doesn't describe each one separately. What it does give is the overall result, which matters more: five of the six patterns showed little awareness that private information was leaking at all What privacy oversight patterns emerge when people review AI agent responses?. Only one of the six looks like real oversight. So the useful lesson isn't six types of reviewer. It's that most of the ways people review agent output don't catch privacy problems.

A related 300-person survey shows how bad this gets. When people compared an agent's reply with what they would have written themselves, they picked the AI reply that leaked private information 55% of the time, compared with a 15.7% baseline Do people notice when AI agents leak private information?. The researchers don't read this as people knowingly trading privacy for convenience. They read it as overtrust: the reply sounds fluent and helpful, and the leak doesn't register. The same blind spot shows up with LLM memory. In one study, over 30 of 40 users never noticed that their assistant had stored or inferred private details about them. Once they were shown, every one of them wanted controls to edit and delete that memory Do users notice when LLMs infer and retain private information?. People do care about privacy. They just can't see the leak while they're reviewing.

This gap is clearer next to research on what people say about privacy. An analysis of Reddit discussions of ChatGPT sorted users into four self-described stances: proactive, inquisitive, convenience-first and resigned What different ways do people handle AI privacy concerns?. Those are attitudes. The six patterns are behaviors observed while reviewing real agent output. Someone who calls themselves privacy-proactive can still approve a leaky email draft, because stated concern and moment-to-moment checking are separate skills. Personalization makes this harder: research following users over time found that as a chatbot gets to know you, trust and privacy risk both go up Does chatbot personalization build trust or expose privacy risks?.

So the main design lesson is that adding a 'let the user approve it' step won't fix the problem on its own. One proposed alternative splits the work by role: users state their privacy preferences once, and the AI enforces them, instead of users checking every output Does splitting privacy work between users and AI reduce cognitive burden?. Another clue comes from research on delegation. People withdraw trust and ask for approval when an action can't be undone and is visible to others, such as sending an email, more than when the stakes are simply high What makes people distrust AI agents they delegate to?. That suggests putting privacy checkpoints exactly where people are already paying attention, at the point of sending.

One more twist for anyone who thinks reviewing the agent's reasoning would help: reasoning traces leak too. In one study, 74.8% of privacy leaks in reasoning came from the model directly pulling up sensitive user data while it thinks, and longer reasoning leaked more Do reasoning traces actually expose private user data?. Showing users more of what the agent is thinking can expose more private data, not less.