Ghost Tool Calls: Issue-Time Privacy for Speculative Agent Tools
2026-06-01 • Cryptography and Security
Cryptography and SecurityArtificial IntelligenceComputation and Language
AI summaryⓘ
The authors studied how language agents use early guesses (speculative tool calls) to make things faster, but these guesses accidentally reveal what the user might do before the agent fully decides. They call this problem "ghost tool calls" because the information leaks even if the agent later changes its mind. Their solution, Speculative Tool Privacy Contracts, treats these early guesses as a special kind of action that can be controlled separately. They found that only changing or blocking these guesses right when they happen can reduce the risk of leaking user intent, while later fixes don’t help much.
language agentsspeculative executiontool callsuser intentprivacy leaksruntime abstractionaccess controlspeculative dispatchpost-hoc filtersprivacy contracts
Authors
Bardia Mohammadi, Lars Klein, Akhil Arora, Laurent Bindschaedler
Abstract
Tool-augmented language agents speculatively issue likely future tool calls to hide latency, but those calls leak inferred user intent to external services before the agent commits to the branch. Every external observer that received the call retains the disclosure after the agent abandons the branch. Timing is the issue, not authorization: no commit-time cleanup, read-only restriction, or access-control allow-list unsends what an observer already holds. We call these invocations ghost tool calls and propose Speculative Tool Privacy Contracts, a runtime abstraction that treats observation before commitment as a first-class effect, distinct from state mutation. We implement the contracts in a prototype runtime and evaluate twelve policies across three corpora. Speculative dispatch increases what an observer can infer about user intent; post-hoc filters, read-only restrictions, and access-control allow-lists leave that inference intact; only issue-time policies that change or suppress the speculative call's argument or destination projection before dispatch reduce it.