Unlearning methods that pass TOFU and MUSE leak on 22-86% of agent queries.

K-Bench scores unlearning across all six channels a ReAct agent exposes, including chain-of-thought, tool calls and tool observations, counting a leak if the secret appears anywhere. When the secret sits in the prompt or retrieval store, the standard benchmarks report no leakage while the deployed agent leaks it on 22-86% of queries, with the secret surviving verbatim in the tool-observation channel. When the secret is in the weights, none of twenty published methods demonstrably removes it, and the top-ranked method changes with the base model.