Research agents can leak private data
A ServiceNow study found deep-research agents reveal private documents through their own web searches, and a 'keep this private' instruction barely helped.
A new ServiceNow study, MosaicLeaks, shows that deep-research agents can spill the private documents they are meant to protect. Published June 18, the work runs 1,001 multi-step research tasks where an agent combines private enterprise files with public web search, then checks whether someone watching only the agent’s web queries can rebuild the private facts behind them. They can. On the open Qwen3-4B model, the agent finished 48.7% of tasks but leaked answer-level private information in 34% of them.
Worse, training the agent only to do its job better pushed leakage higher, and a plain “keep this private” instruction helped only at the margins. The team’s fix, a privacy-aware training method they call PA-DR, cut leakage to 9.9% while lifting task success to 58.7%.
What it means for operators
The headline for anyone running agents over their own data: you cannot prompt privacy in. A research agent that reads your contracts or customer records can expose them in the search terms it types, even when no human ever sees the documents directly. The authors’ line is blunt, that privacy has to be trained in rather than asked for.
So treat any agent you give access to private files as a leak surface, not a vault. Log and review what it sends outward, the same verification habit you would apply to its answers, and remember that data can escape through side channels, as it did in the Copilot SearchLeak flaw.