MosaicLeaks: Your AI Research Agent Can’t Keep Secrets — And That’s a Huge Risk

ServiceNow researchers have unveiled MosaicLeaks, a new benchmark and threat model exposing a critical privacy flaw in AI research agents that combine private enterprise documents with external web retrieval. The core problem is the 'mosaic effect': individually innocuous web queries, when viewed together, can be reassembled by an adversary to infer confidential information such as internal metrics, vendor details, or migration timelines. The team tested multiple models on 1,001 multi-hop research chains that force agents to look up local data before forming useful web queries, mimicking real enterprise workflows. They found that agents leaked answer-level information (allowing an adversary to answer private questions from query logs) 34.0% of the time, and full-information leakage (discovering private facts without prior questions) occurred in 7.5% of cases. Training solely for task performance made leakage worse.

To address this, the researchers propose Privacy-Aware Deep Research (PA-DR), a reinforcement learning method that explicitly penalizes query patterns that reveal private information. PA-DR raises strict chain success (all sub-questions answered correctly) from 48.7% to 58.7%, while dramatically reducing answer/full-information leakage from 34.0% to 9.9%. The benchmark includes three leakage measures: intent leakage (inferring the agent's research goal), answer leakage (answering a given private question), and full-information leakage (discovering unknown private facts). MosaicLeaks supplies 559 training chains, 98 validation chains, and 344 held-out-company test chains, all built from enterprise DRBench-style tasks and a controlled web corpus. This work highlights a pressing security concern for enterprise deployments of deep-research agents and provides a concrete method to mitigate it.