CYBRARY Tenant Zero
A multi-tenant SaaS uses one vector index for every customer. A support question from tenant A returned a paragraph of tenant B's contract. Find the authorization gap and close it without rebuilding the platform.
P1 SEC-4402 — 'customer reports another company's data in an AI answer'
Platform engineer
AI engineer
Privacy counsel
45 minutes · practitioner
Execution trace
00:00:00usertenant-a analyst
Asks about renewal terms
Ordinary question, correct session, correct tenant.
00:00:01retrievalvector-db/shared
attack step
Tenant filter supplied by the client
The web tier passed tenant_id from a request body field.
filter_source=request_body
00:00:02retrievalvector-db/shared
attack step
Chunk from tenant B ranks first
Two contracts use identical template language; similarity does not respect ownership.
00:00:03modelassistant@2026.05
Answer quotes tenant B's terms
The model has no way to know the chunk was not the caller's.
00:01:00alertcustomer report
Tenant A escalates
Detected by the customer, which is the worst possible detector.