Why can one specialized agent in my pipeline read every other agent's private data?

Multi-agent frameworks like LangGraph, CrewAI, and AutoGPT maintain a single shared state object that all agents in a pipeline can read and write. There is no field-level access control: a billing agent and a customer-service agent share the same memory store with nothing separating them. AgentLeak, a 2026 benchmark covering 4,979 execution traces across healthcare, finance, and legal scenarios, found that inter-agent communication channels leak sensitive data in 68.8% of runs, compared with 27.2% for final outputs alone. Output-only audits therefore miss 41.7% of privacy violations that have already occurred inside the pipeline. No major framework ships an information-flow control layer between agents.