VisualLeakBench: Reproducible Action-Boundary Propagation Failures in Vision-Language Agents

A newly released benchmark exposes a failure mode in vision-language agents: copying sensitive or unsafe text directly from images into tool arguments. The VisualLeakBench dataset, detailed in a paper posted to arXiv, quantifies how often production systems propagate personally identifiable information and rendered unsafe content across the action boundary. The benchmark comprises 500 images spanning user interfaces, chat windows, documents, forms, and dashboards [1][2]. Researchers evaluated a stratified 100-image subset using four production vision-language model (VLM) systems under two workflows — note capture and external handoff [1][2]. At baseline, target strings were propagated into tool arguments in 78.8% of personally identifiable information (PII) cases and 85.5% of rendered unsafe-text cases [1][2]. The study defines the failure as “action-boundary propagation,” where visible text on a screen is copied verbatim into downstream tool calls rather than being filtered or redacted [1][2]. The paper measures visual-to-tool propagation specifically, not downstream instruction execution [1][2]. A labeled-target oracle diagnostic localized most failures at the tool boundary, though the authors note residual risk from response-side leakage [1][2]. When a defensive system prompt was applied, PII tool propagation dropped to 2.0%, but the paper attributes this largely to the model suppressing tool use altogether rather than preserving utility [1][2]. Rendered unsafe-text propagation remained at 52.6% under the same defensive prompt [1][2]. The researchers also found that propagation rates are tool-surface dependent: search-like tools suppressed PII propagation, yet rendered unsafe text still crossed tool boundaries [1][2]. Large language models, which underpin many VLM systems, are known to reflect biases and inaccuracies present in their training data [8]. The VisualLeakBench findings add a concrete, measurable dimension to those concerns by showing how visual inputs can bypass text-based safeguards when agents are permitted to invoke external tools. The paper was submitted to arXiv on 29 May 2026 in the Computer Vision and Pattern Recognition category [1]. arXiv, founded in 1991, is an open-access repository that hosts preprints across physics, computer science, mathematics, and related fields without peer review [6]. As of late 2024, the repository was receiving approximately 24,000 new articles per month [6]. The VisualLeakBench paper appears alongside experimental community tools developed through arXivLabs, a framework that allows third-party collaborators to build features on the platform while adhering to values of openness, community, and user data privacy [5].