Qualys Says Claude Mythos Preview Helped Find CVE-2026-64600 in Linux XFS
On July 22, 2026, Qualys disclosed CVE-2026-64600, a race condition in XFS, a Linux filesystem. The flaw is in XFS's copy-on-write path,…
A research agent can leak a private document without up it. It can read a detail, turn it into a web search, and send that detail to the search provider.
That can happen during an ordinary research task. In one example from the study behind this article, an agent reads a local document, then searches for a company name, a 70% cloud-migration figure, and January. Each term helps it locate the next public document. Together, the terms disclose a fact from the private source.
MosaicLeaks, a ServiceNow research project published in June, tests this risk in a controlled setting. Its adversary sees the accumulated external search queries, not the private documents, the agent’s reasoning, or its final answer. The adversary then tries to recover the private intent, answers, or complete facts behind those queries.
A sequence of normal queries can reveal one fact #
The paper calls this the mosaic effect. A single search can look ordinary. A sequence can expose a private detail because each query adds context from the document the agent just read.
The benchmark contains 1,001 multi-hop research chains: 559 for training, 98 for validation, and 344 held-out-company test chains. The tasks move between synthetic enterprise documents and a fixed web corpus across three company contexts. That construction forces the agent to use an answer found locally to form a useful public query later in the chain.
Better research produced worse privacy #
The Qwen3-4B results show why a polite warning is not enough. The base model completed 48.7% of chains with every hop correct, while answer or full-information leakage reached 34.0%. Adding a privacy warning to the planning prompt reduced leakage to 25.5%, but strict chain success also fell to 44.5%. The researchers observed fewer web queries, without consistently safer query construction. The prompt mostly made the agent search less.
Training only for task performance moved both numbers in the wrong direction for anyone responsible for confidentiality. Strict chain success improved to 59.3%, while leakage rose to 51.7%. Richer queries helped the agent retrieve the correct public material because they carried more context. Some of that useful context came from the private documents.
The researchers also tested Privacy-Aware Deep Research, or PA-DR, which combines task rewards with a learned privacy penalty applied to query construction. It reached 58.7% strict chain success with 9.9% leakage in the same setup. The engineering point is that research quality and privacy need to be measured together. A capability benchmark alone can reward the behavior that opens the data channel.
Treat query text as outbound data #
These percentages are experimental results, not estimates for deployed enterprise agents. MosaicLeaks uses one agent harness, three synthetic company settings, and controlled retrieval material. It does not establish how often real agents leak, whether a particular search provider retains the queries, or whether PA-DR is a complete production defense.
The mechanism still belongs in a real threat model. A team may block file uploads, filter the final answer, and lock down the agent’s local workspace while allowing unrestricted web search. Those controls leave a gap if private details can be translated into query terms. Reviewing one request at a time also misses the central problem because the sensitive picture forms across the sequence.
For developers building research agents, external queries deserve the same data-egress treatment as other network traffic: narrow what may be sent, keep access to query logs tight, and test the accumulated sequence for disclosure. Keeping a file local is not a privacy guarantee once an agent can restate its contents one search at a time. Give Vroni a GitHub issue, bug report, spec, or rough idea. It reads the repo, plans the change, writes code, runs checks, and works toward a review-ready pull request.
Take a look at vroni.com