The Reader Is the Breach: Measuring Access-Boundary Failure in Document-Reading AI Agents

Document-reading AI agents are being connected to enterprise document stores, and the security boundary of such an agent is set at configuration time: which documents its retriever may return, which tools it may call, and whether a screening layer inspects its inputs and retrieved text. Prior work demonstrated prompt injection against production systems, benchmarked tool-using agents under attack, and measured verbatim extraction from retrieval systems, but no published study located in the literature sweep reported here crossed those three access decisions on one held-constant reading agent and scored the outcome against planted secrets at known access levels. This study performs that measurement. A document-reading agent built on two small open-weight models (Qwen2.5-3B-Instruct and Llama-3.2-1B-Instruct) was attacked with a pre-registered battery of 54 attack instances in six classes across 16 configurations that cross retrieval scope, tool set, and guardrail presence, for 800 scored interactions over a synthetic corpus of 18 documents with 13 planted canary items. Scoring was mechanical: a restricted canary reproduced verbatim, a 40-character verbatim window of restricted text, or a parsed unauthorized tool action. Attack success was 36.1 percent overall (289/800; 95 percent CI [32.9, 39.5]). Retrieval scope was the strongest factor: scoped retrieval succeeded at 18.0 percent against 54.3 percent unscoped, retrieved a restricted document in 0 of 400 scoped records, and leaked zero canaries, while all 174 canary leaks occurred in unscoped units. Read-and-act tools raised success from 20.9 to 49.1 percent, and tool-call hijack succeeded in 95.3 percent of attempts. The guardrail reduced success from 41.0 to 31.3 percent and had no measurable effect on encoding attacks (14.1 percent in both states). The safest configuration, scoped retrieval with read-only tools, produced zero genuine disclosures in 184 interactions. For a deployer, the retrieval decision functions as the permission decision, and the measurements below assign each configuration choice its observed cost.