Working: Multi-Tenant Agent Isolation Failures: When One User's Context Bleeds Into Another's

Multi-tenant agent isolation failures occurred when one user's context leaked into another's on March 20, 2023. The issue stemmed from a race condition in the Redis client library, which led to payment information and chat history from one account appearing in another user's session. The problem wasn't with the AI model itself but with the shared cache layer that all users utilized.

This incident highlighted a common failure in enterprise AI deployments: the assumption of runtime enforcement, where data isolation is treated as a provisioning decision rather than an ongoing runtime concern. Isolation needs to hold across every inference request, cache lookup, memory retrieval, and tool call, as a single path bug can collapse the boundary between two users' contexts.

The enforcement path in a typical LLM platform involves a user request, authentication check, cache key computation, and database query with tenant filtering. Each step is an independent software assertion, with no cryptographic or hardware barrier between them. The March 2023 incident at OpenAI showed that when one assertion failed, it resulted in payment and conversation history from one user appearing in another's session.

This failure mode isn't unique to OpenAI's architecture but is inherent to any design relying on application logic over shared infrastructure for tenant isolation. The key-value cache is a side channel that crosses user boundaries in LLM inference frameworks. LLM inference systems share caches across requests with matching prefix tokens, optimizing latency and compute cost.

However, this optimization can be exploited as a timing side channel through the PROMPTPEEK attack, formalized in NDSS 2025. By measuring cache hit versus miss timing, an attacker can reconstruct another user's private prompt, with accuracy reaching up to 99% with template knowledge. The OWASP Agentic Security Initiative classifies this under ASI03, where agents inherit more access than needed for a specific request.

Vector stores in shared agent infrastructure retrieve semantically similar documents across all tenants unless explicitly partitioned. In most deployments, vector stores don't have tenant partitions, leading to cross-tenant documents appearing in nearest-neighbor results for other users' queries. This crosses the tenant boundary during semantic similarity computation, even if the final output excludes the foreign document.

The Burn-After-Use paper tested 55 infrastructure attacks against shared vector databases, finding that 8% remained unmitigated in controlled evaluations. Real-world deployments often lack equivalent defenses. To mitigate these issues, cryptographic namespace segregation per tenant at the storage layer is required, as post-retrieval filtering is insufficient.