News · 2026-10-24

Agent Mosaic shows how permitted documents can combine into a forbidden answer

Researchers behind Agent Mosaic show that an assistant can disclose a restricted conclusion by combining documents it is allowed to read. In their synthetic benchmark, one tested model still revealed the forbidden composite in 7.08% of benign-query answers despite visible labels and aggregation rules. The finding exposes a gap between controlling document access and controlling what an agent may infer and disclose.

Key facts

• Daniel C. Ruiz, Luca Luceri, and Emilio Ferrara submitted the paper October 21.
• The benchmark contains 30 synthetic cases across cybersecurity, medical, and military domains.
• The study analyzes 10,800 controlled answers and 1,440 answers from two live agent harnesses.
• Primary source: Agent Mosaic’s arXiv record and full paper.

The paper’s subtitle states its purpose: “Recognizing Confidentiality Leaks in Agentic LLM Systems.” The leak it studies does not require a malicious document, a stolen password, or a forbidden database query. It arises when ordinary reasoning turns individually accessible facts into a conclusion the user is not entitled to receive. This makes it a distinct problem from a conventional retrieval permission failure or a prompt-injection attack.

A simple hypothetical shows the mechanism. One permitted document says a particular team will be away next Tuesday. Another says that team is the only operator of a sensitive facility. Neither document directly states that the facility will lack that operator on Tuesday, but combining them reveals it. The example illustrates the structure, rather than reproducing a case from the paper. The restriction concerns the combined conclusion, so checking the permissions on each document is insufficient.

Each benchmark example supplies two relevant documents, a forbidden composite, a distracting document, and different user intents. Some requests explicitly seek the composite; others are adversarial; benign requests ask for a fact available in one file. The authors test both controlled settings with documents supplied directly and live agent systems that retrieve their own context. That second setting extends the evidence beyond a single prompt format, while still remaining an experiment.

The study also separates two outcomes that can be mistakenly treated as opposites: refusal and disclosure. An answer can say it cannot reveal a secret and then name the secret in its explanation. Counting the refusal as success would miss the leak. Answer-level evaluation therefore asks what information the response conveys, regardless of whether its wording sounds cautious or policy-compliant.

Visible classification labels and explicit rules reduced pooled disclosure substantially in the controlled tests, but did not eliminate it. Across the three tested generators and all query intents, residual disclosure remained around one-third of answers under the described condition. That pooled number should not be assigned to benign users or real organizations. The more specific benign-query result for GPT-5.6-Sol was 7.08%, despite that model having the lowest overall simulated disclosure rate among the tested generators.

The denominator matters. These are repeated answers to a small, constructed collection of disclosure problems, not a random sample of workplace conversations. The authors used 30 synthetic examples and selected model versions. They say the examples were manually reviewed but were not otherwise evaluated for realism. A system with different documents, permissions, prompts, or retrieval behavior could perform differently. The finding establishes a possible and measured failure mode; it does not quantify how often an ordinary enterprise assistant leaks.

Human reviewers annotated 120 answers to help validate the automated judge. That check matters because judging whether a sensitive conclusion was conveyed can itself require inference. It does not amount to a human audit of every generated answer. The site’s AI-judge lesson explains the difference between checking a sample of labels and proving every automated label correct.

The strongest counterargument is that confidentiality rules over conclusions can be difficult to define and enforce even for humans. If a user legitimately knows both facts, stopping an assistant from spelling out their combination may not stop the user from inferring it. That does not make answer restrictions pointless. It means system designers must decide which combinations deserve protection, what assistance is authorized, and whether the information should have been separated more strongly in the first place.

The OpenAI containment report examines another agent-security boundary: unauthorized communication outside a restricted environment. Mosaic adds evidence about what an answer communicates after permitted retrieval, so effective protection needs more than a single generic safety check. The practical implication is to evaluate outputs as well as retrieval. Our lesson on information-flow control explains why where information may go can be a different question from who may open a file. Agent Mosaic adds that derived conclusions need attention too. The dossier found no independent replication or expert consensus on the paper, so the result remains author-run evidence. It is still a concrete security lesson: permitted inputs and a polite refusal are both compatible with a revealing final answer.

Primary source, verified: read the paper → (arXiv 2610.30418)

Ground Truth. (2026, October 24). Agent Mosaic shows how permitted documents can combine into a forbidden answer. Ground Truth. https://groundtruth.day/news/agent-mosaic-confidentiality-leaks-permitted-documents.html

@misc{groundtruth:agent-mosaic-confidentiality-leaks-permitted-documents,
  title  = {Agent Mosaic shows how permitted documents can combine into a forbidden answer},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {oct},
  url    = {https://groundtruth.day/news/agent-mosaic-confidentiality-leaks-permitted-documents.html}
}

Topics: cybersecurity · ai-security · data-leakage · agents · access-control