Can Your Research Agent Keep a Secret? Every Query Looks Harmless, Together They Leak
ServiceNow's MosaicLeaks turns the vague worry about research agents leaking into a measurable property. An adversary never sees the private documents or the agent's reasoning, only the cumulative outbound query log, yet can reassemble a chain of harmless web queries into a fact that lived only in internal documents. That is the mosaic effect. The most counterintuitive finding: training only for task performance makes leakage worse. ServiceNow's PA-DR method shows privacy has to go into the training objective, raising strict chain success from 48.7% to 58.7% while cutting answer and full-information leakage from 34.0% to 9.9%. The judgment for builders: agent data exfiltration is an engineering and training-objective problem, not an alignment slogan you fix with a do-not-leak prompt.
Read analysis