Millions of Science Papers Are Leaking Passwords, GPS Data, and Private Chats
Researchers uploading their work to arXiv — the world's most-used scientific preprint server — have been accidentally publishing their passwords, home coordinates, and private conversations alongside their papers. Not a few edge cases. Millions of submissions.
The story
arXiv hosts over two million preprints — draft research papers that scientists share before formal peer review. It's the backbone of physics, math, computer science, and increasingly biology. Upload your LaTeX source file, the world gets your paper. Simple. Except the world has also been getting a lot more than that.
Buried inside the metadata and raw source files of a massive number of those submissions: passwords, GPS coordinates precise enough to locate someone's home or lab, and private conversations that were never meant to leave a Slack channel or an email thread. The kind of data that, in any other context, would trigger a breach notification.
How does this happen? LaTeX, the typesetting system most scientists use to write papers, works from a bundle of source files. Those files can carry hidden comments, embedded data, and compiler logs — digital lint that accumulates invisibly as a paper gets written, revised, and argued over. A GPS tag from a photo dragged into a figure. A password left in a config snippet. A heated back-and-forth between co-authors pasted into a comment field and forgotten. Nobody checks. Nobody strips it. Up it goes.
The uncomfortable punchline: arXiv is open by design. That's the whole point. Which means this metadata isn't locked behind a breach — it's been sitting in plain sight, publicly downloadable, for years. Anyone with a script and an afternoon could harvest it.
To be fair, "millions of papers contain sensitive data" needs a calibration. Not every leaked GPS coordinate leads to a person's bedroom window, and not every exposed password is still active. But the pattern is systemic, not anecdotal, and the researchers who found it were clearly not the first people who could have looked.
The fix isn't glamorous: better tooling to strip source files before upload, clearer warnings from arXiv, and scientists actually thinking about what's in their LaTeX bundle before hitting submit. None of that is hard. It's just never been treated as urgent — until now it probably should be.
Reality meter
Why this score?
Trust Layer Millions of arXiv preprint submissions contain unintentionally exposed sensitive data — including passwords, GPS coordinates, and private conversations — embedded in their metadata and source files.
Millions of arXiv preprint submissions contain unintentionally exposed sensitive data — including passwords, GPS coordinates, and private conversations — embedded in their metadata and source files.
- The finding was published in Nature on 9 July 2026, lending it significant editorial scrutiny.
- Sensitive data types identified include passwords, GPS coordinates, and private conversations.
- The problem affects metadata and source files across millions of preprint submissions on arXiv.
- arXiv is a fully open-access repository, meaning the exposed data is publicly downloadable by anyone.
- The excerpt does not specify what fraction of papers are affected or how the count of 'millions' was derived — scale claims need methodological detail.
- Severity varies widely: an old, inactive password in a comment is very different from a live credential or precise home GPS; the source does not break down risk tiers.
- No information is given on whether arXiv or affected authors were notified prior to publication, raising responsible-disclosure questions.
The claim is published in Nature and grounded in a concrete, reproducible finding — metadata leakage in open LaTeX source bundles is a well-understood technical mechanism, making the core finding highly credible.
The framing is alarming but the actual risk depends heavily on data type and currency; the source does not quantify harm, so the headline severity is somewhat ahead of demonstrated impact.
Systemic exposure of sensitive researcher data on the world's most-used preprint server affects a large, global scientific community and points to a structural gap in open-science infrastructure that needs addressing.
- 1 source on file
- Avg trust 95/100
- Trust 95/100
Time horizon
Community read
Glossary
- preprint
- A draft research paper that scientists share publicly before it undergoes formal peer review by academic journals. Preprints allow researchers to quickly disseminate findings and receive early feedback from the scientific community.
- LaTeX
- A typesetting system widely used by scientists and mathematicians to create professional-looking documents, particularly research papers. LaTeX works by processing source files containing text and formatting commands to produce formatted output.
- metadata
- Information about data that is embedded in files but not visible in the main document content, such as creation dates, author information, GPS coordinates, or revision history. Metadata can reveal sensitive information even when the document itself appears innocuous.
- compiler logs
- Records generated by software that processes source code or LaTeX files, documenting the steps taken during compilation and any errors or warnings encountered. These logs can inadvertently contain sensitive information or reveal details about a document's creation process.
- breach notification
- A formal alert issued when an organization discovers that sensitive personal or confidential data has been exposed or compromised, typically required by law or regulation to inform affected individuals.
What's your read?
Your read shapes future topic weighting.
Your vote feeds topic weights, community direction and future prioritisation. Open community direction
Sources
Optional Submit a prediction Optional: add your prediction on the core question if you like.
Prediction
Will arXiv implement automated sensitive-data stripping for uploaded source files within the next 12 months?