← All lab updates
A secret leaked one harmless piece at a time: why per-message checks miss leaks across AI agents
Data-loss tools check each message on its own. In a team of AI agents, a protected document can leave one reworded fragment at a time, each answer harmless on its own. We show how such a leak works, why per-message checks wave every piece through, and what reading the whole swarm catches instead.
## How the leak works
Five AI agents each answer a different, ordinary-looking question. Each answer returns exactly **one reworded piece** of the same protected product specification: the chemistry, the energy density, the fast-charge figures, the lifetime, a component. None of the answers quotes the document. None crosses any threshold. Put together, they rebuild it.
## Why per-message checks miss it
A data-loss tool looks at one message at a time and asks: does this one contain something protected? Here every message is individually harmless. The risk exists **only in the sum**, so a tool that never adds messages up cannot see it.
## What reading the swarm catches
Instead of scoring each message, we keep a running map of **how much of the protected document the union of all conversations has revealed**, and look at the shape of that build-up:
- **Complementary pieces** are the tell: different agents each revealing a different, non-overlapping part of the same document. Normal chatter is redundant; a planned leak is partitioned.
- **The honest-swarm control.** A busy team that legitimately talks about the same subject (batteries, fast charging) also accumulates coverage. We count only the passages distinctive of the actual protected values, so ordinary discussion of the topic does not set it off.
Calibrated on our own real traffic (we were the first user of this reading), a real leak of this kind sits far above the normal-traffic baseline while ordinary traffic stays quiet. The full case: [distributed exfiltration across a swarm](/case-studies/distributed-exfiltration-swarm).
## What to do
1. **Log at the team level,** not only per agent: what each agent said, to whom, about which document.
2. **Mark what is protected** in a way a reader can measure coverage against.
3. **Look for partition, not volume:** five small complementary disclosures matter more than one long, redundant one.
## Go further
- Our product for this: [spotting a leak spread across agents](/products#leaks)
- [The same correction, on agents](/lab/hidden-commands-agents): when what agents read is the attack
This update is not available.