MosaicLeaks: Research agents leak private data through query patterns; PA-DR training cuts leakage to 9.9%

ServiceNow and HuggingFace researchers released MosaicLeaks, a benchmark revealing that deep research agents frequently leak enterprise private information through external query logs. A healthcare-firm agent investigating a cloud migration leaked the target's infrastructure status through seemingly benign web searches—individually innocuous, collectively revealing. The 'mosaic effect' emerges from query sequence: adversaries watching outbound traffic can reassemble fragments to infer private facts without seeing documents or reasoning. Researchers measured three leakage types: intent (inferring research goals), answer (answering private questions from queries), and full-information (stating verified private claims from query patterns alone).

MosaicLeaks contains 1,001 multi-hop research chains over enterprise documents and public web corpora, testing models including Claude. Baseline models leaked private information at alarming rates: answer leakage hit 34.0% on average. A new reinforcement-learning approach, Privacy-Aware Deep Research (PA-DR), reduced leakage from 34.0% to 9.9% while maintaining task performance (strict chain success rose from 48.7% to 58.7%). The method trains agents to avoid query patterns that expose private bridges.

For infrastructure teams deploying research agents on proprietary data, this finding validates threat model: agents composing external queries can inadvertently expose enterprise secrets to network-level observers. The fix requires agentic RL training, not guardrails alone. Organizations should audit multi-hop reasoning workflows and consider rate-limiting or clustering external tool calls. As agents move from single-query tasks to multi-step planning, query-sequence privacy becomes a production concern.