Skip to content

AI Agent Privacy Notice#21

Open
Dinzeyi2 wants to merge 3 commits intotylerprogramming:mainfrom
Dinzeyi2:main
Open

AI Agent Privacy Notice#21
Dinzeyi2 wants to merge 3 commits intotylerprogramming:mainfrom
Dinzeyi2:main

Conversation

@Dinzeyi2
Copy link
Copy Markdown

@Dinzeyi2 Dinzeyi2 commented May 4, 2026

Secure your agents at: CodeAstra.dev

AI Agent Privacy Risk

This PR adds a short README notice about a possible privacy pattern found in this project.

The concern is not an API key leak. The concern is that sensitive user, customer, or patient data may be passed directly into an AI agent / LLM context.

When this happens, the agent may see data it does not need to know in order to complete the task.

Safer pattern:

John Smith -> [CVT:NAME:user_name]
john@email.com -> [CVT:EMAIL:user_email]
04/12/1988 -> [CVT:DOB:user_dob]

The agent can still reason and perform the workflow, while the real values stay protected and are only re-injected during approved execution.

File scanned: crewai_supabase/main.py

Findings:

[
  {
    "type": "unblinded_ai_call",
    "evidence": "agent(role='supabase agent', goal='you will perform executions on the supabase database.', backstory=f\"\"\"\\n        you are a master at performing executions on the supabase database.\\n        you are able to perform the following operations:\\n        - get a row from the database.\\n        - get all rows from the database.\\n        - insert a row into the database.\\n        - delete a row from the database.\\n        - update a row in the database.\\n        \\n        for insert operations, the input should be a string containing the input to insert, all columns data should be in a data dict field in the string.\\n        \\n        for delete operations, try to get the row you are deleting firs"
  },
  {
    "type": "unblinded_ai_call",
    "evidence": "task(description='answer the following questions about the database: {question}.', expected_output='you are to return the result of the operation you performed.', agent=agent)"
  },
  {
    "type": "unblinded_ai_call",
    "evidence": "crew(agents=[agent], tasks=[task], verbose=true, process=process.sequential)"
  }
]

Please review before merging. If this is not applicable, feel free to close this PR.

Secure your agents at: CodeAstra.dev

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant