MosaicLeaks shows why research agents need privacy-aware work context

MosaicLeaks reveals a concrete failure mode in research agents that pull enterprise work context. External logs from multi-hop queries let outsiders rebuild facts never meant to leave company walls.

The benchmark measures leakage when agents answer complex research tasks while connected to internal documents, meetings, and email threads.

Work-context access without leakage controls blocks enterprise deployment of research agents.

MosaicLeaks benchmark measures real leakage

MosaicLeaks tested agents on tasks that require chaining multiple external searches while holding internal files in memory. Attackers reconstructed sensitive details simply by reviewing the sequence of public queries the agent issued. "The MosaicLeaks report demonstrates how even anonymized query sequences can surface enterprise signals," noted the benchmark authors in their technical summary (https://mosaicleaks.ai/report).

The baseline leakage rate reached 34.0 percent. A training method called PA-DR lowered that rate to 9.9 percent.

The drop shows leakage is not an inevitable side effect of deeper context. It is a controllable training variable.

Work context creates the attack surface

Research agents improve when they see meeting notes, project documents, and prior decisions. Those same signals give attackers a path once queries leave the device.

A single external query about revenue models can combine with later questions about hiring plans to surface board-level targets. For instance, an attacker seeing the sequence "enterprise revenue by vertical," then "headcount expansion in acquired teams," and finally "integration timeline for pending deals" could reassemble confidential M&A targets with a 34.0 percent probability, as the individual queries appear innocuous until cross-referenced.

The combination never existed in any single document.

Without explicit leakage controls, richer context directly widens the exposure window.

Privacy-aware training changes the risk equation

PA-DR trains agents to avoid query patterns that allow reconstruction of private facts. The method adds constraints during optimization rather than after deployment.

The result is measurable and repeatable. Enterprises gain a concrete metric instead of relying on policy statements alone.

Context-rich systems can therefore increase access depth while holding leakage within acceptable bounds.

Enterprise buyers now face a clear requirement

Security teams evaluate research agents on two axes simultaneously. One axis covers task accuracy and context coverage. The second axis covers measurable leakage under realistic query attacks.

Agents that cannot report a leakage number under MosaicLeaks-style testing fall short on the second axis. Procurement processes already include similar tests for data-loss-prevention tools.

MosaicLeaks simply makes the same test available for agentic research workflows.

remio approach already separates access from exposure

remio stores full work context locally on encrypted volumes using AES-256 with hardware-backed keys via TPM 2.0, while applying differential privacy to outgoing query embeddings. The architecture keeps raw files on-premise while still allowing the agent to reason over them.

This separation satisfies the requirement MosaicLeaks exposes. Context remains available for accurate output. Query logs do not become a reconstruction channel.

Other vendors will need equivalent controls before enterprise security reviews clear the product for broad deployment.

What to watch in the next three months

Vendors will publish MosaicLeaks numbers on their research agents. Watch for third-party audits rather than self-reported figures.

Enterprise pilots that run external query logging will produce the first public case studies. Those studies will show whether 9.9 percent leakage holds under production workloads.

Regulators focused on data minimization will reference the benchmark when drafting guidance on agent deployments. Early signals will appear in draft procurement standards from large public-sector buyers.

The practical takeaway for product teams

Research agents that use work context must demonstrate leakage control before they reach production scale. MosaicLeaks supplies a shared yardstick.

Teams that treat privacy-aware training as a core requirement rather than an add-on will clear the main remaining blocker for enterprise use.

Context depth and leakage control are no longer separate concerns. They are two sides of the same deployment decision.