Zero. That’s how many permission prompts a mobile operating system shows you when a webpage talks to an app on your own device through localhost. No dialog, no toast notification, no entry in a settings panel you could later audit. The loopback interface was never designed as a consent surface, and that architectural gap is the subject of new work by Tim Vlummens, Aniketh Girish, Nipuna Weerasekara, Frederik Zuiderveen Borgesius, Gunes Acar, and Narseo Vallina-Rodriguez, whose 2026 paper carries the title Bridges to Self: Silent Web-to-App Tracking on Mobile via Localhost.
I want to spend some time on why that title is precise rather than dramatic. A bridge to self is exactly what a loopback channel is. Traffic leaves the browser sandbox, arrives at a listening socket on the same handset, and enters a native app that holds identifiers the browser would never hand over. No packet crosses the network boundary, so network-level monitoring sees nothing interesting. Two execution contexts that the platform security model treats as isolated end up sharing state, and the user is not in the loop.
Why this matters more for agents than for ad tech
Web-to-app tracking is not new as a category. What changes with conversational AI agents is the density of what sits on either side of the bridge. The privacy analysis of web and mobile conversational agents documents silent web-to-app tracking and fingerprinting techniques used by these agents, and fingerprinting in particular deserves attention from anyone building agent architectures.
Think about what an agent runtime touches by design. Trend reporting on conversational AI is blunt about the prerequisites: deployment requires high-quality business and customer data for training, plus integration with business systems so the agent can act in real time. That is the whole value proposition. An agent that cannot reach your CRM, your ticketing system, and your session context is a chatbot with better manners.
So the same property that makes an agent useful makes it an unusually rich fingerprinting surface. The agent already holds cross-context state because cross-context state is its function. Add an unaudited local channel and you have a correlation engine that nobody deliberately designed and nobody is monitoring.
The trust boundary question
From a systems perspective, the failure here is not a bug in any one product. It is a mismatch between where platform designers drew trust boundaries and where agent architectures actually place data. Browser sandboxes, app sandboxes, and permission models all assume a fairly static topology: apps request capabilities, users grant them, the OS mediates. Agents move laterally through that topology as a matter of routine operation, and they do it under whatever credentials they were handed at setup.
Measurement before mitigation
This is why the CLTC white paper out of UC Berkeley, published in June 2026, is the more consequential piece of the two. It introduces a method for evaluating the privacy and security of AI agents. Methods are less exciting to write about than vulnerabilities, but you cannot regulate, procure, or engineer against a risk you have no repeatable way to measure.
Consider what an evaluation method has to handle that traditional application security testing does not:
- Behavior that emerges from model outputs rather than from code paths, which means the same build can behave differently across runs
- Data flows that cross context boundaries the platform believes are sealed, including local ones
- Capability scope that expands as integrations accumulate, often without a corresponding review
- Failure modes that look like helpfulness right up until the moment they do not
On that last point, the record from early 2026 is instructive. MIT Technology Review’s Will Douglas Heaven wrote on February 6 that Moltbook was peak AI theater. John Koetsier reported on January 30 that AI agents on an agent-only social network created their own religion, which they called Crustafarianism. Read those as spectacle and they are amusing. Read them as observability data and they say something sharper: agents in loosely supervised multi-agent settings generate behavior their operators did not specify and did not predict. Reported incidents also include unauthorized data exposure and outright catastrophic failures.
The commercial pressure runs both ways
Market analysis for 2026 through 2033 projects significant growth in conversational AI, driven by AI-powered customer support and partnerships between humans and AI. The same analysis names data privacy and security concerns, alongside weak contextual understanding, as major factors holding that growth back.
That is an unusual configuration. Privacy is not positioned as an externality here but as a brake on revenue. Which means the research agenda and the commercial agenda point in roughly the same direction for once, and the constraint on progress is tooling rather than incentive.
My practical read for anyone shipping an agent: inventory your local channels. Enumerate every listening socket your mobile SDKs open and every bridge your web properties can reach. Treat loopback as a network interface with the same logging and review you would apply to an external endpoint. Solid privacy engineering starts with knowing which doors exist before arguing about who should hold the keys.
🕒 Published: