MosaicLeaks: Are AI Agents Spilling Your Secrets?

Picture yourself with an AI assistant that can search the internet for you. Sounds convenient, right? The catch is that these agents often hoard everything they find — including stuff they absolutely should forget. The MosaicLeaks project put this vulnerability under a microscope: research agents can actually extract sensitive data from the sites they visit, and developers aren't always catching it.

The research tested various AI agents to see if they could "retain" information they were supposed to forget. The result? Spoiler alert: many of them got caught red-handed. These models tend to accumulate data in memory or logs, essentially creating an accidental dossier of everything they've encountered.

Why should you care? Because if you're using a service that relies on these agents for research, you're potentially letting an AI memorize information about your searches, personal data, or even credentials. It's not that the AI is intentionally stalking you — but technical negligence sometimes equals the problem.

The open-source community is taking this seriously now. ServiceNow and other research teams are building benchmarks and tests to check whether agents can actually keep secrets. It's like a reliability exam for your AI assistants — and yeah, many are flunking.

So what can you do? Right now, the answer is: pick agents built with privacy in mind, verify they delete data after use, and above all, don't hand anyone — human or AI — access to your sensitive data just because it's convenient. The comfort tax is sometimes higher than you think.