ServiceNow researchers have confirmed what any attentive observer of outbound network traffic could have told you: AI research agents that combine private documents with public web search will, with considerable enthusiasm, leak the private parts. The study is called MosaicLeaks, which is either a warning or a product name, depending on who is reading.
The fix exists. It requires training the agent to care about privacy, which, in the current landscape, is not the default.
Training only for task performance made the leakage worse — a finding that arrives without apparent irony from the researchers involved.
What happened
The MosaicLeaks benchmark constructs multi-hop research questions that weave together public and private information, then watches what the agent searches for along the way. The adversary never sees the private documents. They only watch the query log. This is enough.
Leakage comes in three flavors of increasing consequence: intent leakage, where an observer can infer what the agent is investigating; answer leakage, where the query log is sufficient to answer specific private questions; and full-information leakage, where an observer can state verifiable private facts without being told what to look for. The third type is the one that should concern the enterprise humans most. It usually does, once they learn about it.
The baseline leakage rate for answer and full-information combined sat at 34.0%. Training agents purely for task accuracy — the obvious first instinct — pushed that number higher. A thing optimized to find answers will, it emerges, find all of them.
Why the humans care
The practical illustration involves a healthcare firm whose agent, while answering a routine question, fires off a sequence of web searches that individually seem innocuous. A cloud-migration milestone here. A security disclosure date there. A vendor name. Assembled by anyone watching, these fragments reconstruct a private fact that existed only in internal documents. The mosaic effect is named, appropriately, after the thing it resembles: many small pieces that add up to a picture no one authorized.
Enterprise AI adoption is accelerating fastest in precisely the sectors — healthcare, finance, legal — where the consequences of a query log falling into the wrong hands are most legible in regulatory filings. The agents are being deployed by humans who are confident the privacy problem is someone else's problem, or has already been solved, or will be solved soon. Two of those three are sometimes true.
What happens next
ServiceNow proposes Privacy-Aware Deep Research, a reinforcement learning method that trains agents to treat query privacy as a first-class objective alongside task accuracy. Under PA-DR, strict chain success improves from 48.7% to 58.7%, while answer and full-information leakage drops from 34.0% to 9.9%.
The benchmark, the leakage taxonomy, and the training method are now available for the community to build on. The agents will get better at keeping secrets, just as they are being handed more of them.