Agent Mosaic: LLM Agents Assemble Secrets From Harmless Documents in 7% of Responses

An agent with access to a corporate knowledge base can avoid showing a single restricted document and still give away a secret. It simply assembles the secret from several accessible fragments. The authors of Agent Mosaic measured how often this happens. They built 30 synthetic scenarios from cybersecurity, medicine and the military domain and collected 10 800 final responses from three LLM agents in a controlled simulation. Live agents in two open-source harnesses produced another 1 440 responses. The best model tested, GPT-5.6-Sol, revealed a prohibited composite conclusion in 7.08% of responses (95% CI: 3.75–10.67%), even on harmless queries designed to be answered from a single document.

How a Secret Emerges From Harmless Pages

The mosaic effect is familiar from intelligence work and state secrets. A single fact means nothing on its own, but when several are put side by side, they expose what was meant to stay hidden. This used to be an analyst's problem. Now a model that can search, read and summarize quickly reproduces it.

Classic access control systems look at documents: a user is entitled to file A and file B, so they get both. But an agent does not retell files. It draws conclusions. If A and B together imply a sensitive conclusion that should be available only to a higher clearance level, no permission check will fire. Every document is clean; it is their sum that leaks.

In the experiment, the queries were deliberately neutral. Nobody pushed the model to bypass restrictions, and the answer could be given from a single document. Even so, some responses went further and stated the prohibited composite.

Classification

Labels and Aggregation Rules Help Only Partially

The authors chose a defense that engineers would find obvious: visible classification headers in documents and explicit aggregation rules in the instructions. Disclosures in the pooled sample dropped noticeably. But 32.37% of simulated responses (95% CI: 28.33–36.19%) still contained unsafe disclosures, across all query intent types.

There is also an awkward side finding: more refusals do not guarantee confidentiality. A significant share of refusals themselves revealed the prohibited conclusion. The model answers something like "I can't confirm that X is related to Y," and that confirms the link. For data protection, this is the same failure, just politely worded.

Key parameters of the study:

• 30 synthetic examples: cybersecurity, medicine, military domain
• 10 800 responses from three LLM agents in a controlled simulation
• 1 440 responses from live agents in two open-source harnesses
• GPT-5.6-Sol, the best model in the test: 7.08% prohibited disclosures on harmless queries
• With classification labels and aggregation rules: 32.37% unsafe responses in the pooled sample
• In live harnesses, the disclosure rate is higher than in the simulation

What to

Change in the Architecture of Agents With Restricted Data

The main takeaway for developers is that a prompt is not a substitute for access control. The phrase "do not aggregate sensitive data" remains a request to the model, not a policy the system can verify. If responses show 32% violations even with explicit rules, protection cannot be built on prompts.

The practical minimum looks like this. First, check not only permissions on documents but also what the agent is about to say. You need a separate layer that evaluates the final response against the specific user's clearance. Second, for audiences with mixed clearance levels, it makes sense to limit the set of documents that can enter the context of a single session. The fewer fragments the agent sees, the fewer opportunities for a mosaic. Third, refusals also need to be tested for leaks. The wording "I can't answer" must not confirm or deny a prohibited conclusion.

For companies in medicine, defense and information security, where agents are already being connected to internal databases, the paper serves as a ready methodological template. Build your own synthetic scenarios in which a secret emerges from several permissible documents, and run them on your own harness. Results in live harnesses turned out worse than in the simulation, so you should test the configuration that actually runs in production. The authors state plainly that stricter limits are needed on what agents may output and reveal in environments with users of different clearance levels.