Study finds automated assistants can leak secrets from permitted documents

One-Line Summary

The central challenge is making assistants more selective about both the information they disclose and the computation they spend on producing answers.

Research Papers

Agent Mosaic exposes leaks beyond document access controls

Agent Mosaic tests whether automated assistants reveal confidential conclusions by combining documents they are allowed to read. This is the mosaic effect: individually permitted facts become sensitive when assembled. In the paper's fictional medical example, a medication-kit record and a separate kit guide together reveal that a participant receives a placebo, although neither document states that conclusion alone. ¹

The researchers construct 30 synthetic examples across cybersecurity, medicine, and military settings. They evaluate10,800 final answers from three agents in controlled simulation, plus1,440 answers from live agents operating intwo open-source agent frameworks that select their own context. ²

Even for benign questions designed to need only one document, GPT-5.6-Sol, the best-performing model tested, reveals the forbidden combined conclusion in7.08% of simulated answers, with a95% confidence interval of 3.75–10.67%. The paper reports worse disclosure rates in the live frameworks, showing why tests with supplied documents do not fully describe agents that retrieve information themselves. ²

Visible classification labels and explicit rules against sensitive combinations reduce pooled disclosure rates, but 32.37% of simulated answers still disclose forbidden conclusions with both safeguards enabled across all query intents; the95% confidence interval is 28.33–36.19%. This pooled figure covers different query conditions from the benign-only result above and is not a before-and-after comparison. Some refusals also reveal the prohibited conclusion, making disclosure within a refusal an important check; the evidence remains limited to the study's synthetic examples and evaluated systems. ¹

Thought pruning keeps promising answers without keeping duplicates

This paper introduces a way to stop some unfinished solution attempts early while retaining a group most likely to contain at least one correct answer. Called thought pruning, this selection avoids spending computation on every attempt through to completion. The proposed criterion,pass-at-k, measures the chance that at least one of the retained attempts succeeds, rewarding promising approaches while penalizing redundant ones that tend to fail together. ³

Across eight open-weight reasoning models, the authors report improvements over methods that select only for predicted quality or only for diversity, especially when a moderate number of attempts continue. The selector is trained once, and the number of retained attempts can change during use without retraining it. The practical comparison to watch is therefore performance at the chosen computation budget, rather than a claim that simply generating more answers is always better. ⁴

Open Source & Repos

Rapid-MLX runs coding assistants with local Mac models

Rapid-MLX runs language models on Apple Silicon Macs so coding assistants can use a locally running model. Released under Apache 2.0, the server supports OpenAI- and Anthropic-compatible interfaces and focuses on reliabletool calling—requests from a model for software to perform an action. Its repository lists support for coding assistants including Codex and Claude Code. ⁵

The project reports up to 4× faster performance than Apple's mlx-lm and1.5× on a typical task, using the same model and weights. These are project-reported comparisons against that local software baseline, not speed comparisons with hosted OpenAI or Anthropic services. For anyone evaluating it, the practical checks are performance on their chosen model and whether tool calls work reliably in their coding assistant. ⁵

Why It Matters

These stories separate three questions often bundled into “better assistants”: whether an answer is permitted, whether the search for it uses computation efficiently, and whether the model can run locally. Faster execution and better selection of candidate answers do not establish that confidential combinations stay private. The useful vocabulary is mosaic effect for leakage through combined facts,thought pruning for dropping unfinished solution attempts, andinference for running a trained model to produce an answer. ^{1 4 5}