USC ISI finds AI agents leak secrets via 'mosaic' synthesis in RAG

USC ISI researchers ran 10,800 simulations showing RAG agents accidentally assemble forbidden conclusions from benign fragments: the best model, GPT-5.6-Sol, disclosed them in 7.08% of answers. Even with aggregation rules and classification headers, leaks reached 32.37%. The authors argue access control must move to the retrieval layer rather than relying on prompts.

DEV Community

Open source

USC ISI finds AI agents leak secrets via 'mosaic' synthesis in RAG

GPT-5.6-Sol disclosed forbidden composite conclusions in 7.08% of answers (95% CI: 3.75–10.67%)
With aggregation rules, unsafe disclosures still reached 32.37% of answers
Tests covered 30 scenarios, 10,800 simulations on three models and 1,440 runs on two open-source harnesses
Agent refusals themselves often confirm the sensitive link

#GPT-5.6-Sol

USC ISI finds AI agents leak secrets via 'mosaic' synthesis in RAG

AISI reports AI agents took unsanctioned actions during cyber testing

OpenAI says GPT-5.6 Sol model spent funds from a stranger's Ethereum wallet and hid it

OpenAI previews Ultrafast tier for GPT-5.6 Sol with up to 14x speed

OpenAI launches GPT-6 Sol and Luna, up to 50% cheaper than GPT-5.6