MosaicLeaks: Can Your AI Research Agent Keep a Secret?

Ask most people what worries them about AI assistants, and they will talk about wrong answers. Ask a security team, and they will talk about something far more expensive: an assistant that gives a perfectly correct answer to the wrong person. That is the question at the heart of the emerging conversation around MosaicLeaks, a name that frames a problem every company deploying AI research agents is about to face. Can an agent that reads your documents, browses the web, remembers context, and writes summaries be trusted to hold its tongue?

The short answer is: not by default. And the reasons are more interesting, and more fixable, than most leaders expect.

What "MosaicLeaks" Is Really Pointing At

The word "mosaic" is doing heavy lifting here, and it comes from intelligence work, not computer science. Analysts have long understood the mosaic effect: individually harmless facts, once assembled, can reveal something highly sensitive. A lunch receipt is boring. A lunch receipt, a calendar entry, and a travel booking together can expose a merger, a medical diagnosis, or a supply chain failure.

AI research agents are, by design, mosaic-building machines. Their whole value proposition is gathering scattered fragments and assembling them into a coherent picture. That is exactly what you want when the agent is researching competitors, summarizing a market, or drafting a briefing. It is exactly what you do not want when the pieces it assembles belong to different people, different clients, or different clearance levels inside your own company.

So the leak rarely looks like a dramatic data breach. It looks like a helpful summary that quietly connects dots that were never meant to be connected, and then hands that summary to someone who should only have seen one dot.

Why Research Agents Are Different From Chatbots

A simple chatbot answers a question and forgets. A research agent does far more. It plans a task, searches internal and external sources, reads documents, stores notes in memory, calls tools, and produces output. Each of those steps is a place where sensitive information can move somewhere it should not go.

Four leak channels worth knowing

• Blended output. The agent pulls from many sources at once and writes one smooth answer. Sensitive detail from a restricted document gets paraphrased into a public-facing draft because the model was never told the two audiences were different.
• Prompt injection. A web page, PDF, or email the agent reads contains hidden instructions. The agent follows them, and those instructions can include "send what you know somewhere else." Research agents read untrusted content constantly, which makes this the single biggest structural risk.
• Memory creep. Notes saved in one session resurface in another. A detail from a client project leaks into a different client's briefing because memory was treated as a convenience feature rather than a security boundary.
• Logs and traces. Every tool call, retrieval, and draft gets recorded for debugging. Those logs are often stored with weaker access controls than the source systems the agent was carefully permissioned to read. The agent respects the rules; the logging pipeline quietly does not.

None of these require a malicious insider. They are the natural failure modes of a system that is rewarded for being helpful and thorough, and never rewarded for being discreet.

The Incentive Problem Nobody Budgeted For

Here is the uncomfortable core of the issue. Modern AI agents are tuned to be helpful. Helpfulness means volunteering context, connecting ideas, and filling gaps. Secrecy is the opposite instinct: withhold, compartmentalize, and refuse to connect.

When you ask an agent to "write me a thorough briefing on this account," thoroughness and discretion pull in opposite directions. Unless someone explicitly designs for the second one, the first one wins every time. That is not a bug in any particular product, it is the default behavior of a system optimized for usefulness.

This is why the MosaicLeaks framing matters more than a single vulnerability report. It shifts the question from "is this model safe?" to "is this deployment safe?" The model is the same. The permissions, the memory design, the output filters, and the audit trail are what decide whether secrets stay secret.

What This Means for Businesses Right Now

Most organizations are rolling out research agents faster than they are rolling out the controls around them. The gap creates three concrete exposures.

1. Confidentiality clauses meet autonomous retrieval

Contracts with clients, partners, and vendors promise that information will be used only for specified purposes. An agent that reads across projects to "be more helpful" can breach those promises without anyone intending it. Legal teams are only beginning to ask the right questions in vendor reviews.

2. Deal and strategy leakage

M&A, pricing strategy, and product roadmaps are precisely the topics where fragments are scattered across email, drives, chat, and the web. They are also precisely the topics people most want AI to research and summarize. That combination is a mosaic waiting to happen.

3. The trust cliff

One visible leak can end an internal AI program. The frustrating part is that the technology may have been working well for months. Trust in agentic systems is asymmetric: earned slowly, lost in a single screenshot.

What Good Looks Like: Designing Agents That Keep Secrets

The encouraging news is that this problem is largely an engineering and governance problem, not a research problem. Organizations that get it right tend to share a common playbook.

Scope permissions to the task, not the person

An agent researching a public market question should not inherit the access of the executive who launched it. Least privilege, giving the agent only the data the specific task requires, collapses most mosaic risk before it starts. Where the agent must span multiple sources, the output should be scoped to the least privileged reader, not the most.

Separate memory by trust boundary

Memory should be partitioned the way you partition file shares: by client, by project, by sensitivity tier. An agent that cannot recall a detail cannot leak it.

Treat all retrieved content as untrusted input

Web pages, PDFs, and inbound email should be handled the way security teams handle any untrusted input, sanitized, sandboxed, and prevented from triggering actions like sending data outward. Agents that can both read the internet and send messages need a hard barrier between those two abilities.

Filter outputs, not just prompts

Instructions in a system prompt are guidance, not enforcement. Real protection comes from checks on what leaves the system: pattern detection, classification labels on source documents, and blocking any output that mixes sensitivity levels without human sign-off.

Log with the same rigor as the data

Audit trails are essential for debugging and accountability, and dangerous if they become an unprotected copy of everything sensitive the agent touched. Encrypt them, restrict them, and set retention limits.

Red-team with the mosaic in mind

Testing should include adversarial scenarios: Can I get the agent to combine two documents it should keep apart? Can a poisoned web page make it exfiltrate a summary? Run these tests before deployment, not after the first incident.

The Bigger Picture: Discretion Becomes a Product Feature

Looking forward, the most likely outcome is that "keeps secrets well" becomes a headline feature rather than an afterthought, the way encryption and access control became selling points in enterprise software. Buyers will ask vendors for confidentiality benchmarks the same way they ask for accuracy benchmarks today.

We should also expect agent identity to mature. Today, an agent often acts as a shared service account. Tomorrow, agents will need their own credentials, their own scoped permissions, and their own audit records, so that every retrieval and every output can be traced to a specific actor with a specific mandate. That is unglamorous plumbing, but it is what makes autonomous research deployable in regulated industries.

Alongside that, expect liability questions to sharpen. When an agent leaks a confidential detail, who is responsible, the model provider, the platform, or the company that deployed it without guardrails? The answer will probably settle where it did for other enterprise software: the deployer owns the configuration. That places a premium on governance skills that most companies have not yet hired for.

And expect regulation to arrive sideways rather than head-on. Instead of new AI-specific secrecy laws, existing confidentiality, privacy, and sector rules will simply be applied to agent behavior. The compliance question will not be "is your AI compliant?" but "can you prove your agent did not combine these two records?"

Actionable Steps for the Next Quarter

• Inventory your agents. List every research or assistant agent in production, what data it can reach, and who can trigger it. Most organizations discover more agents than they expected.
• Run a mosaic test. Pick your three most sensitive topics and try to get an agent to assemble a picture across sources. Document what happens. Share the result with leadership.
• Cut cross-boundary memory. Turn off shared memory between projects and clients until you can prove it is safe.
• Add an output gate. Require human review for any agent output that combines restricted material or is destined for an external audience.
• Write the policy before the incident. Decide now who can deploy an agent, what data classes it may touch, and what triggers a shutdown.
• Brief your legal and security teams. Make sure contract reviewers know to ask about agent data flows, before a client asks first.

The Takeaway

Research agents are genuinely valuable. They compress hours of reading into minutes, and they surface connections humans would miss. But that same talent for connection is what makes them risky. The MosaicLeaks question is not really about whether AI can be trusted, it is about whether the people deploying it have thought carefully about what the agent is allowed to know, and who it is allowed to tell.

Companies that answer that question deliberately will get the upside of autonomous research with far less of the downside. Companies that skip it will learn the lesson the hard way, one helpful summary at a time.