MosaicLeaks: Can your research agent keep a secret?

Researchers have identified a vulnerability called MosaicLeaks that allows unauthorized parties to extract private training data from AI research agents by observing their search queries. By monitoring the specific information these agents access during autonomous tasks, attackers can reconstruct sensitive documents or proprietary datasets. This finding highlights a new privacy risk for developers who rely on automated tools that interact with external databases. Security teams are now advised to implement stricter access controls and data masking to prevent these agents from leaking confidential information during their normal operations.