This paper demonstrates that Web Research Agents (WRAs) are vulnerable to inference attacks from passive network adversaries, such as Internet Service Providers (ISPs). WRAs can be deployed locally by organizations and individuals for privacy, legal, or financial purposes. Unlike sporadic human web browsing, WRAs visit 70-140 domains and have distinguishable temporal correlations, enabling unique fingerprinting attacks. In this paper, we present a novel prompt and user attribute exfiltration attack that leverages only the network-level metadata of WRAs (i.e., the IP addresses and times of visits). We build a new WRA trace dataset based on user search queries and queries generated by synthetic personas. We define an action metric (OBELS) that comprehensively evaluates the similarity between original and inferred prompts. We demonstrate that it recovers over 73% of the functional and domain knowledge of user prompts. Extending to multi-session settings, we recover 19 out of 32 potential attributes with high accuracy. This attack is effective even under partial observation and noisy conditions. Finally, we discuss mitigation strategies that limit domain diversity or obfuscate tracking, and show that they reduce attack effectiveness by an average of 29% without significant utility impact.
