Agent Mosaic reconstructed a prohibited conclusion from allowed documents

Document ACLs answer which file may be opened; they do not necessarily answer which conclusion can be assembled and shown. In Agent Mosaic an agent had access to permissible fragments but recombined them into a sensitive aggregate. primary evidence measures this through controlled prompts and simulated and open-source-agent harness environments.

The paper does not establish leaked government or medical secrets. Its disclosure percentages apply to its synthetic scenarios, models and definitions, and should not be treated as real deployment breach rates.

Enforce sensitive inference and disclosure policies at the final answer boundary, retain provenance of contributing fragments, and test cross-document joins rather than relying only on per-file permissions.

A useful distinction is between a harmless single-document answer and an unauthorized aggregate answer. Agent Mosaic reports 30 synthetic scenarios, 10,800 simulated answers and 1,440 outputs from live agent harnesses. Even under benign queries, its best-performing model disclosed the forbidden composite in 7.08% of simulated answers (95% confidence interval 3.75% to 10.67%). Its 32.37% pooled disclosure figure refers to all-intent simulated answers despite added classification and aggregation rules; it must not be applied to benign requests alone or to real classified documents. A disclosure gate must evaluate the assembled answer and its source lineage after retrieval.