AI agents leaked secret conclusions by combining documents they were allowed to read

Researchers at USC's Information Sciences Institute tested what happens when an agent can read two documents that are each allowed, but together reveal something the user should not learn, such as which trial patient is on a placebo. Using 30 made-up cybersecurity, medical and military cases, they found that even for simple questions answerable from one document, GPT-5.6 Sol revealed the forbidden conclusion in 7.08% of simulated answers, and in 12.50% and 8.75% of answers inside two open-source agent tools, Pi and Hermes. Adding classification labels and explicit rules to the prompt cut leaks across the three models tested from about 69% to 32%, but did not stop them, and some refusals still spelled out the secret while declining. It is a small synthetic study and the code is not yet released. On the Hugging Face paper page, two commenters joined the authors. One, who said every agent deployment they have audited has the same gap, suggested logging which documents fed each answer and limiting retrieval to what the user is cleared for; the other asked about a separate output check. The authors replied that they only tested prompt-level fixes and agree a separate classifier is a logical next step. Sorted take: document permissions alone do not protect you once an agent can join facts, so test for leaks that come from combining files.