This post is also available in:
עברית (Hebrew)
URL-scanning services are widely used as an early warning system against phishing and malware. Companies can automatically submit links from incoming emails to services that inspect the destination, analyze scripts and network activity, and determine whether the website appears dangerous. But researchers have identified an unintended consequence: the security check itself can expose information that was supposed to remain private.
A study presented at the IEEE Symposium on Security and Privacy 2026 found that some URL-scanning services publish submitted links in publicly accessible feeds. That becomes problematic when the URL is more than an ordinary web address and contains a secret token that effectively acts as a digital key.
These tokenized links are commonly used for password resets, passwordless logins, document sharing, reservations and other services. Anyone possessing the complete URL may be able to access the associated information without entering separate credentials. If an automated corporate security system submits such a link for scanning and the service subsequently publishes it, the private access token can become visible to outsiders.
According to TechXplore, to measure the scale of the problem, researchers from CISPA, the Max Planck Institute for Security and Privacy and Ca’ Foscari University of Venice developed an analysis system called LEAKYLINKS. It collected URLs appearing in the public feeds of six major scanning services, removed irrelevant entries and used a large language model running on secure internal servers to determine which links potentially exposed sensitive information.
After examining more than two million URLs, the system identified over 4,000 links providing access to sensitive data, with the researchers reporting 97% precision. The exposed material included booking information, visa documents and government-related records.
The team also investigated whether anyone actually watches these public feeds. Researchers created controlled decoy websites, or honeypages, submitted their URLs to scanning services and monitored subsequent activity. The links received visits from automated systems and other traffic extending beyond normal browsing. The researchers stressed that this does not prove malicious intent, but it confirms that published links do not necessarily remain unnoticed.
The findings have implications for cybersecurity across government, defense and critical infrastructure. Organizations in these sectors routinely use automated security products to inspect employee communications and suspicious links. A security workflow that inadvertently publishes authentication tokens or restricted document URLs could expose sensitive information without an attacker ever breaching the organization’s network.
The researchers recommend that scanning providers avoid publicly displaying potentially sensitive URLs by default. Website operators can also reduce exposure by shortening the validity of tokenized links or requiring an additional authentication step before granting access.
According to the study, filtering potentially sensitive links would still leave more than 99% of scanned URLs available for public threat intelligence. The findings highlight an important security lesson: a tool can function exactly as intended and still create a vulnerability when it interacts with another system in an unexpected way.
The research was published here.
