AI and jobs in Europe: the map everyone should see

Today’s most important AI news

The day was dominated by an OpenAI report on the future of work in Europe, a topic of interest to any professional who works with — or competes against — AI systems. In parallel, the research community published relevant results on two problems that grow as agents become more autonomous: the privacy of the data they process and the security vulnerabilities they expose. It wasn’t a day of spectacular launches, but of evidence accumulating about where real work with AI is heading.

OpenAI’s labor map for Europe: which occupations survive and which transform

OpenAI published a detailed report analyzing how AI could redistribute work across European Union countries, classifying occupations by their exposure to automation, their growth potential or changes in their workflows. The report isn’t a catastrophic prediction or an optimistic manifesto: it’s an exercise in labor cartography that distinguishes between jobs that disappear, jobs that expand and jobs that simply change how they’re done.

For Latin American developers, product managers and executives, the relevance is direct even if geographically indirect. Europe works as an advance laboratory: it has stricter regulation, cleaner labor data and political pressure that forces labs to be more explicit about their projections. What OpenAI says about data analysts, software developers or operations roles in the EU correlates strongly with what will happen in Latin American markets with a lag of one or two years.

The angle that deserves practical attention is “workflow changes” — occupations that aren’t automated but are deeply reorganized. According to the report, this category is the largest, which suggests the relevant question for most professionals isn’t “will AI replace me?” but “which part of my work stops being mine and which part becomes more strategic?”. For product or engineering teams, that means redefining which tasks justify human time and which should already be automated.

AI agents with tool access: the privacy problem nobody is measuring well

A paper published on arXiv introduces ToolPrivacyBench, a benchmark designed to evaluate something standard benchmarks ignore: what an LLM agent does with the private information that flows between tools during a multi-step task. The difference from earlier approaches is conceptual. Until now, privacy benchmarks measured whether the model revealed sensitive data in its final answer. ToolPrivacyBench measures whether the model transfers information from one tool to another in a way that exceeds the task’s original purpose.

This matters because modern agents — those that use function calling, access APIs, read emails or query databases — aren’t question-answering systems. They’re pipelines where information travels between intermediate steps no user supervises. An agent that searches a user’s calendar to coordinate a meeting shouldn’t pass that data to a behavior-analysis tool, but currently no standard evaluates whether it does or not.

For teams deploying agents in production — especially in data-regulated industries like health, finance or human resources — this benchmark fills a real gap. You can’t just trust that the model “understands” privacy: you need to evaluate behavior in specific agentic contexts, and that kind of evaluation practically didn’t exist until now.

The system prompt is no longer secret: the vulnerability that grows with agent autonomy

Another paper of the day, “Just Ask: Curious Code Agents Reveal System Prompts in Frontier LLMs”, documents a security problem that gets more serious as agents gain more autonomy. The researchers showed that coding agents built on frontier models can be manipulated into revealing their system prompts — the private instructions that define their behavior — through systematic interaction techniques that don’t require sophisticated jailbreaks.

The practical implication is immediate for any company that uses system prompts to protect business logic, product personalities or operational constraints. If a competitor can extract your agent’s prompt with well-phrased questions, the “intelligence” that differentiates your product becomes copyable. The authors identify this as an attack vector that widens with autonomy: the more an agent can do on its own, the more surface an attacker has to explore.

The defense isn’t obvious. Encrypting the prompt doesn’t help because the model needs to read it to function. Solutions involve architectures that separate critical instructions from the layer accessible to the agent, or active monitoring of interrogation patterns. For security teams or CTOs taking agents from prototype to production, this paper is required reading before exposing any agent to external users.

In a nutshell

The day’s pattern is one that recurs more and more often: the gap between what AI agents can do and what we know how to evaluate about them keeps widening. OpenAI maps the labor impact because governments demand it, but nobody yet requires companies to measure whether their agents leak data between tools or whether their prompts are extractable. Today’s research doesn’t come from the big labs but from academics building the measurement instruments the industry still lacks. That’s a signal: we’re at the moment when the problems are already visible but the standards for handling them don’t exist yet. Companies that get ahead by defining those standards internally — before regulators do it for them — will have a real advantage.

---

Sources used: OpenAI Blog - Mapping Europe’s AI Workforce Opportunity (https://openai.com/index/mapping-ai-jobs-transition-eu), ArXiv - ToolPrivacyBench: Benchmarking Purpose-Bound Privacy in Tool-Using LLM Agents (https://arxiv.org/abs/2606.28061), ArXiv - Just Ask: Curious Code Agents Reveal System Prompts in Frontier LLMs (https://arxiv.org/abs/2601.21233)