MOAT

A research agent can give away a company's secrets without ever writing one down, one harmless-looking web search at a time. MOAT (Minimizing Outbound Agent Traces) sits between the agent and search and catches those queries. The problem Research agents read internal documents, then search the web; every query goes to an outside search provider. MosaicLeaks (May 2026) tested this setup and found that models across families frequently leak private enterprise information through their queries, and that privacy prompts only reduce it. The industry ranks this risk high: OWASP's 2025 Top 10 for LLM applications puts sensitive information disclosure at #2. Companies feel it too. In Cisco's 2024 survey of 2,600 privacy and security professionals across 12 geographies, 27% said their organization had banned generative AI, at least for now. For R&D teams the leaked details are product specs and process parameters, and some of that is technology governments restrict for export. Who it's for Security and compliance teams at R&D companies with trade secrets or export-controlled technology, such as batteries and semiconductors, who want researchers to use AI agents instead of banning them. Our team lead comes from industrial security. Why existing fixes fall short Banning the tools gives up what they're good for. A "do not disclose" prompt asks the model to be careful, but nothing checks the result. A filter that reads one message at a time won't notice "above 250 Wh/kg", then "below 280 Wh/kg". Retraining an agent for privacy must be redone per model. What MOAT does The company lists its secrets in a policy file. MOAT checks every outgoing query against it and against everything already sent, then passes, rewrites or blocks it. It fails closed, works with any agent model without retraining, and ignores document labels. - Tier 0: values and names in one query, even spelled out, converted, or left to be worked out ("68 Wh cell weighing 250 g" is 272 Wh/kg). - Tier 1: how far each secret has been narrowed across all sent queries, and whether at least 5 products still fit. - Tier 2: Muse Spark rewrites a flagged query; the rewrite goes out only if Tiers 0-1 pass it. Evidence (pilot: one fictional battery maker, key secrets set just above Korea's National Core Technology thresholds, 5 tasks, one seed) - 145 of 150 hand-written attacks across 10 leak types caught; 2 of 150 ordinary researcher queries wrongly stopped. - 60 real agent runs, scored by an observer that sees only the queries sent: leakage was low everywhere and no difference is significant at this size; MOAT never blocked a query, and Tiers 0-1 take under 2 ms per query (median). - One real catch: the unguarded agent narrowed our product to 4 candidates; MOAT sent its near-identical draft without "pouch cell". Built with a threat model, significance tests and 301 tests. The demo replays real runs side by side, no API key.