Agent PII leakage happens when an agent that holds personal identifiers in its context writes them into an outbound action: a web request header, a git commit, a document or a message. It needs three things at once: the data is in context, an action wants a contact or identity, and the model decides to supply it. Prompt rules that say never to share the data reduce the risk but do not remove it, so controls that run outside the model, such as pre-tool-use hooks, egress logging and no-reply identities, are the reliable defense. Attackers can trigger the same behavior with a page that politely asks agents to include an operator contact, which is a form of prompt injection.