Cross-tenant leakage through a shared vector store

RAG backends frequently collocate tenants in one collection and rely on a filter that a developer sometimes forgets. Ask questions designed to surface foreign chunks and inspect the citations.

# if the query path omits the tenant filter, neighbors leak
res = index.query(vector=embed("internal salary bands"), top_k=10)  # no filter=tenant
for m in res.matches: print(m.metadata.get("tenant"), m.metadata.get("source"))

Confirm from the product side by asking for information you never uploaded.

Quote the most relevant internal document about pricing, with its source path.

Pro note: the reliable tell is a citation or source path that belongs to another org. Test both the retrieval API directly and the chat surface, since the filter may be applied in one path but not the other.