Three of five medical AI agents pulled patient identifiers their tasks never needed
Medical agents should fetch patient identifiers only when a task needs them, the HIPAA minimum necessary standard. The authors planted canaries, marked fake identifiers, in synthetic patient records and traced every tool call. Three models called the identifier tools unnecessarily, while Claude Opus 4.8 and GPT-5.5 did not; checking only final answers misses this, because an agent can read data without revealing it. A gate before each call, given the task-necessity rule, nearly eliminated the access.