Tool-augmented language agents speculatively issue likely future tool calls to hide latency, but those calls leak inferred user intent to external services before the agent commits to the branch. Every external observer that received the call retains the disclosure after the agent abandons the branch. Timing is the issue, not authorization: no commit-time cleanup, read-only restriction, or access-control allow-list unsends what an observer already holds. We call these invocations ghost tool calls and propose Speculative Tool Privacy Contracts, a runtime abstraction that treats observation before commitment as a first-class effect, distinct from state mutation. We implement the contracts in a prototype runtime and evaluate twelve policies across three corpora. Speculative dispatch increases what an observer can infer about user intent; post-hoc filters, read-only restrictions, and access-control allow-lists leave that inference intact; only issue-time policies that change or suppress the speculative call's argument or destination projection before dispatch reduce it.

翻译：工具增强型语言智能体会推测性地提前发出未来可能需要的工具调用以隐藏延迟，但这些调用会在智能体确认分支前向外部服务泄露推断出的用户意图。即使智能体最终放弃某分支，所有已接收该调用的外部观察者仍保留着已披露的信息。问题的关键在于时序而非授权：提交时清理、只读限制或访问控制白名单都无法收回观察者已掌握的信息。我们将此类调用称为“幽灵工具调用”，并提出了“推测性工具隐私合约”——一种将提交前观察视为独立于状态变更的一阶效应的运行时抽象。我们在原型运行时中实现了该合约，并在三个语料库上评估了十二种策略。推测性分发会增加观察者对用户意图的推断能力；事后过滤器、只读限制及访问控制白名单均无法消除这种推断；只有在分发前通过修改或抑制推测性调用的参数或目标投递的及时策略才能有效减少推断。