arXiv Papers Leak Sensitive Data Via Metadata

Millions of preprint submissions hosted on arXiv have been found to contain sensitive information inadvertently shared through their metadata and source files. This data includes private conversations, passwords, and GPS coordinates, according to research published in Nature on July 9, 2026. The study highlights a significant security vulnerability in the way researchers handle and submit their work to preprint servers.

The findings indicate that this issue is widespread, affecting a substantial portion of the millions of preprints available on the platform. Researchers examining the submissions discovered that information intended to remain private was embedded within the digital fabric of the documents. This could range from personal notes and communications to technical details that were not meant for public disclosure.

The implications of this data leakage are far-reaching. Exposed passwords could lead to account compromises for individuals, while GPS coordinates might reveal sensitive locations. Private conversations, if uncovered, could have personal or professional repercussions for the authors. The research underscores the critical need for greater awareness and stricter protocols regarding data handling and submission practices within the scientific community.

While the study does not name specific individuals or institutions, it points to a systemic problem that requires attention from both researchers and preprint server administrators. The arXiv platform, a widely used repository for scientific papers before peer review, now faces scrutiny over its role in potentially exposing sensitive data. The findings suggest that current practices for sanitizing documents before submission are insufficient, leaving authors vulnerable to unintended disclosure.