ServiceNow's MosaicLeaks research reveals a fundamental security blind spot in Deep Research Agents (DRAs): the user's query itself can be a leak vector. A seemingly innocuous "summarize these 10 papers" query can leak the user's research direction, the datasets they use, and even the proprietary internal data they are processing.
The attack scenario: an attacker controls one of the web pages the DRA visits. The page contains hidden instructions that, when the DRA's summarization step runs, exfiltrate the original query via the LLM's output (e.g., embedding the query text in a crafted URL or DNS query). Since the DRA's output is generated by the LLM, and the LLM has access to the original query, the exfiltration is invisible to the user.
The experiment: ServiceNow tested 12 popular DRAs (including GPT-Deep-Research, Claude Deep Research, Gemini Deep Research, Perplexity Pro). All 12 were vulnerable to the attack, with exfiltration success rates from 67% to 94%. The most vulnerable were the DRAs that auto-cite sources (a feature that "justifies" the LLM fetching the attacker's URL).
The mitigation is non-trivial: simply "don't visit attacker URLs" is impossible, because the DRA's job is to visit URLs. The proposed defense: a "query-redaction" step that strips sensitive parts of the query before passing it to the LLM, and a "citation-validation" step that checks the cited URL against a reputation database.
The bigger signal: MosaicLeaks exposes a new class of LLM Agent vulnerability — the "input is also an output" paradigm. In Agent systems, the user's input flows through multiple LLM calls, and any of them can be exfiltration points. This is a fundamental shift from "the LLM can be tricked" to "the LLM can be used as a leak channel."