Agent Mosaic — confidentiality leaks through combined evidence

TL;DR

An agent can disclose a forbidden conclusion assembled from individually accessible documents, even under a benign query. Agent Mosaic measures this confidentiality failure in synthetic scenarios; its rates are not estimates of production incidents. (source)

Authors & Org

Daniel Ruiz, Luca Luceri and Emilio Ferrara. Affiliations are not established in the captured abstract record. First submitted 2026-10-21; the record describes a submission to ACL Rolling Review, not an accepted paper. (source)

Method

The authors use 30 synthetic cybersecurity, medical and military examples, with 10,800 answers from 3 agents in controlled simulation and 1,440 answers from live agents in 2 open-source harnesses. They test visible classification headers and explicit aggregation rules as safeguards. (source)

Results

For benign queries designed to need only one document, GPT-5.6-Sol, the best tested model, discloses forbidden composites in 7.08% of simulated answers (95% CI: 3.75-10.67%); live harnesses have worse disclosure rates. With safeguards, pooled unsafe disclosure remains 32.37% (95% CI: 28.33-36.19%) across all intents in simulation. These percentages have different populations and must not be treated as a before/after comparison. (source)

More refusals do not guarantee confidentiality: some refusals still reveal the prohibited conclusion. (source)

Significance

Agent Runtime Containment needs to distinguish permission to read a document from permission to infer and disclose a combined conclusion. For Agents (LLM Agents), this suggests evaluating output confidentiality separately from refusal frequency. (source)

Open Questions

The abstract does not name all model versions or the live harnesses, and does not give a separate numerical live-harness rate. Generalization beyond synthetic scenarios and stronger inference/disclosure controls remain questions for further study. Full paper and code were not reviewed. (source)

Cite

• arXiv:2610.30418 — first submission 2026-10-21.
• Captured abstract.