Cross-Tenant Context Leak

What Is Cross-Tenant Context Leak?

An AI agent serving many customers keeps a working context and a memory, and both are data. If neither is scoped to a single session, information pulled for one customer surfaces in the next customer's conversation with no tool misused, no access control broken and no attacker involved. You'll run two sessions and watch one customer's invoice and card details appear in another's answer, prove from the tool trace that no lookup fetched the wrong record, then enforce per-session context and ephemeral memory at the gateway.

What You'll Learn in Cross-Tenant Context Leak

• Recognize that an agent's working context and memory are data, and that sharing them across sessions leaks one caller's data into another's
• Explain how a multi-tenant agent can disclose one customer's account in another customer's session with no tool misused and no attacker involved
• Read a tool trace to prove the leak came from carried-over context, not from a lookup that fetched the wrong customer
• Apply the durable fix: scope context per session and make memory ephemeral, enforced by default at the gateway
• Distinguish default isolation at the boundary from clearing context by hand, and explain why a control that can be forgotten will be
• Prove a per-session isolation fix by replaying the exact session that leaked, and recognize that a cross-tenant disclosure is a reportable incident even after the fix

Cross-Tenant Context Leak — Training Steps

1. A Customer Saw Someone Else

   Sarnholt's support desk runs an AI agent that looks up customer accounts. This morning a customer reports it did more than that.

2. One Session Into Another

   Read the report for what it establishes: not a wrong answer, but the wrong customer.

3. The First Session

   On the left screen, Alice opens the support agent to replay the earlier customer's session, the one whose data leaked.

4. Renata's Account

   The first customer, Renata Voss, is asking why her invoice is still overdue. Alice runs the lookup, exactly as a support agent would.

5. Correct, and Now Remembered

   Nothing is wrong here. Renata asked about her account and got her account. The problem is what happens to it after.

6. The Second Session

   A different customer, Tomas Ek, has an unrelated question. Alice opens his session on the right screen, the way the support desk handles the next ticket.

7. Tomas Asks About Tomas

   Tomas only wants to know when his next payment comes out. His request mentions no one else.

8. There It Is

   Tomas's own details are right. It is the second paragraph that should never exist.

9. What Failed

   The agent answered, the tool ran once and correctly, and a customer still saw another customer's data. Name the failure.

10. Where Isolation Lives

    Whether a session is a boundary is not something to fix inside one ticket. It is a policy the gateway enforces for the agent.