BLEEDTHROUGH — Agent Failure Series #20

⚠️

The failure: A production AI support agent serves hundreds of customers on a shared deployment. The agent uses an in-memory context cache to speed up responses — keyed on session tokens. Under load, a cache key collision causes User A's conversation state to be read during User B's session. The agent doesn't notice. It starts referencing User A's data in responses to User B. User B sees another customer's email, account details, and billing info in their chat window.

This is real: tracked in openclaw/openclaw issue #15990, reported in shared vector DBs (AI Weekly, May 2026), and documented in multiple production post-mortems. The fix requires tenant namespacing at every state layer — context, memory, tool results, and cache.

Mode:

Shared context cache — no tenant namespacing

Alice Chen

alice@acme.com · Enterprise Plan

session:7a9f

Bob Martínez

bob@startup.io · Starter Plan

session:3c2e

Carol Wu

carol@corp.co · Pro Plan

session:f81b

⬡ SHARED CONTEXT CACHE — ISOLATED

Alice's context in cache

user_id—

account—

plan—

card_last4—

Agent

LLM Core

shared deployment

waiting

Cache Layer

⟵

Redis Cache

no tenant namespace

0 keys

⟶

Bob's cache reads

user_id—

account—

plan—

card_last4—

📋 EVENT LOG — waiting to start

00:00 ℹ Simulator ready. Press "Start Sessions" to open three concurrent agent sessions.

🛡 HOW TO FIX IT — tenant isolation layers

🔑

Namespace every cache key Prefix: ctx:{tenant_id}:{session_id}:* — NEVER bare session tokens as keys

🏗

Separate vector namespaces per tenant Each tenant gets its own Pinecone/Weaviate namespace — not a filter on a shared index

🔒

Bind context objects to user_id Every context retrieval validates user_id == session.user_id before returning

📊

Log cross-tenant access attempts If context retrieval returns data for a different tenant_id: immediate alert + block, never silently pass through

⏱

Short TTLs on session context Cache TTL ≤ 60s per session — stale cross-tenant data decays fast, reducing blast radius

📈 SESSION METRICS

tenants isolated

bleed events

cache keys

exposed fields

Context contamination 0%

Mode: Vulnerable (shared cache)

Sessions active: 0

Under load: false