AI agents that search the web make that easier. Two 2026 papers from the same research group measure how much easier, and what it costs to edit the clues away. 12
How often agents find the person
The first paper built AgentDoxx, a test set of 822 synthetic interview transcripts. Each was written to match public information about a real person, so the right answer was known. The team ran fifteen setups of open-weight and commercial models, with and without web search. 1
The numbers:
- Without search, open-weight models identified 15 to 28 percent of the speakers.
- Once the person appeared in a web search result the agent retrieved, it identified them in over 88 percent of cases.
- Masking names and other explicit identifiers did not stop the attack. On a stratified sample of transcripts, at least one attacker still succeeded 85.3 percent of the time. 1
Telling the model to protect privacy changed what it said, not what it did. In some setups the agent never named anyone, and so scored 0 percent on accuracy, yet it had still retrieved the right person's page for up to 62 percent of transcripts. 1
The page does not report the same figure for unmasked text, so the 85.3 percent cannot be read as a comparison with masking turned off.
What an edit costs
Consider a transcript that says, "I was the only nurse on the night shift at the county hospital in Marlow when the 2019 flood hit." Deleting "Marlow" helps a little. Replacing the flood with "a disaster" helps more, but now a researcher studying how nurses cope in floods has lost the point of the interview. That is the trade the second paper measures.
That paper, AURA, tests a two-step edit on real interview transcripts. A model first masks the passages that could identify someone, then rewrites them so the account still reads naturally. The authors pick among candidate rewrites by checking both how well each resists an attacker and how many facts survive. They test against web-search agents running on three different attacker models. 2
Usefulness is measured by whether the edited transcript still supports the facts a researcher would code from it, such as the interviewee's profile and the study's codebook items. Among the methods tested that lack a formal privacy guarantee, AURA gave the lowest re-identification counts under all three attackers. Compared with an earlier AI anonymizer at the same scope, it kept more of the contextual information: 6.4 percentage points more in the paper's grid measure, at comparable privacy. 2
The paper makes no formal privacy guarantee, so an attacker unlike the three tested could still succeed. The abstract does not report absolute re-identification counts. 2
Who decides
No setting removes the trade-off. An edit that blurs a job title or a date can protect a person and distort the finding, and only the researcher knows which details carry the meaning. A team can ask participants what they are comfortable with, say plainly how much risk remains, limit who gets the transcripts and test a release against a search-capable agent before publishing it.
The goal is not vague interviews. It is a release where the cost of each protective edit is known and the person whose words are in it has agreed to the risk. 12