QueryShadow

Inspiration

AI agents increasingly mix confidential context with public search. A provider may never receive the source file, yet it can still see every query derived from it. Individually, those searches may look harmless; together, they can reconstruct a private fact. QueryShadow was built to make that cumulative mosaic leakage visible before an agent sends the trail.

What it does

QueryShadow replays an AI agent’s outbound searches and treats the ordered sequence—not a single prompt—as the unit of privacy risk. It:

• shows cumulative exposure rising across the trace;
• reconstructs what a plausible outside observer could infer;
• links every inference to the literal bridge evidence that enabled it;
• rewrites only identities, values, dates, locations, percentages, and other revealing details;
• estimates retained research utility and residual exposure; and
• exports a transparent JSON mitigation receipt.

The judge path is instant, browser-local, no-login, and needs no API key. Three synthetic scenarios cover M&A diligence, clinical research, and an unreleased product launch.

How we built it

The interface uses React 19 and TypeScript on Vinext/Vite, deployed through OpenAI Sites and Cloudflare Workers. A deterministic analyzer extracts signal classes, accumulates context in query order, identifies bridge-entity joins, generates minimal generalisations, and creates stable audit IDs. Imported traces stay in memory and are not transmitted.

What makes it different

Most privacy controls inspect one prompt, file, or tool call at a time. QueryShadow treats the cumulative ordered trace as the security boundary and closes the loop from reconstruction to evidence to safer query plan to residual-risk receipt.

Challenges

The hardest problem was making cumulative inference legible without pretending a heuristic score proves that any provider actually made the inference. We also had to preserve downstream research utility: simply deleting every exact detail would be private but useless. The product therefore exposes its evidence, frames scores as review priority, and makes narrowly targeted rewrites.

Accomplishments

We produced a complete public, no-secret demonstration with three domain-distinct traces, accessible responsive UI, trace import, audit export, transparent limitations, deterministic tests, and a sub-three-minute narrated demo.

What we learned

Privacy boundaries for tool-using agents cannot stop at individual calls. Ordering, repetition, and bridge facts matter. The safest useful intervention is often not blocking a query, but generalising the one detail that links it to the rest of the trail.

Built with Codex and GPT-5.6

QueryShadow was created in one primary Codex task using GPT-5.6 Sol at Ultra effort. Codex helped with public-web gap research, collision checks, threat-model translation, adversarial fixtures, deterministic scoring, implementation, UX, accessibility, tests, deployment repair, and submission packaging. Runtime model calls were intentionally excluded so the privacy demo remains local, instant, and reliable.

What’s next

A production version would add live agent-trace adapters, organisation-specific sensitivity labels, calibrated adversarial reconstruction evals, enforcement hooks, and policy review. This prototype is a review debugger, not a claim that an external provider actually inferred the displayed facts.

Built With

• cloudflare-workers
• gpt-5.6
• openai-codex
• openai-sites
• react
• typescript
• vite