Designing for Privacy When Behavior Is the Signal

Local Web and Research Agents are neither wholly private nor wholly public. They can keep a prompt and retrieved content away from a cloud provider while still exposing a structured record of the work to a network observer. The central design question is therefore not “is the agent local?” but “which observer can see which signal, and what can that signal support?” Answering that question lets a developer or deploying organization reduce unnecessary exposure without pretending that a benchmark score or a protocol name is a complete privacy guarantee.

The evidence assembled here supports a clear but bounded conclusion. An agent's autonomous browsing behavior can reveal immediate task intent, identify the traffic as agent-like, and—when sessions can be linked—support longer-term trait inference. The USENIX study demonstrates those possibilities under controlled conditions. ECH and Oblivious DoH can hide or split important network identifiers, but their specifications protect different fields and leave explicit residual channels. Behavioral defenses can reduce the mapping between task and trace, but they cost resources and do not erase every signal.

The privacy problem is the behavior produced by the agent

The simplest mental model treats privacy as a property of the prompt: if the prompt stays on the local machine, it is private. The stronger model treats the prompt as the beginning of a control loop. It influences which searches the agent issues, which sources it visits, how widely it explores, and when it stops. The resulting destinations, order, timing, and traffic volume become an external representation of an internal task.

That representation supports three related forms of exposure. Agent attribution asks whether the traffic looks like autonomous research rather than ordinary browsing. Prompt recovery asks what the user is trying to learn or accomplish in the current session. Trait inference asks what repeated sessions imply about the user. They are not the same prediction, but they share a causal path: a hidden intention shapes agent behavior, the behavior creates metadata, and an observer applies a model to the metadata.

The study's reported results make the progression concrete. WRA traffic remained separable from selected human sessions, with 97.9 percent global classification accuracy under the study's setup. Prompt recovery reached high functional and domain-equivalence scores in the main benchmark, summarized by the paper as recovering more than 73 percent of the functional and domain knowledge. In the multi-session experiment, some synthetic personas exposed up to 19 of 32 traits at the high-similarity threshold after seven sessions. None of these figures means that every local agent exposes every user's complete prompt or that every trait prediction is true. They mean that the behavioral channel carried enough signal for useful inference under defined conditions.

The channel is also shaped by system design. A research agent that visits more sources may produce a better-grounded report, but it also gives the observer more destinations to correlate. A local backbone may browse less broadly than a stronger proprietary model, reducing some exposure while changing utility. A stopping rule that prevents redundant exploration may lower the trace without changing the answer. These are privacy-relevant choices even though they may first appear to be questions of performance, cost, or orchestration.

This is why the correct unit of analysis is not a single hostname. The observer can combine domains, order, bursts, approximate timing, and payload sizes. A domain can be more informative when it appears after a particular search service or alongside a cluster of specialist sources. A sequence can reveal the shape of an investigation even when no full URL or page text is visible. A repeated pattern across sessions can reveal more than any one request.

The observer's position still matters. A DNS resolver, an ISP, an enterprise firewall, a VPN operator, and a shared network service do not see identical fields.