Cross-tenant leakage through a shared vector store
If embeddings from multiple tenants share an index without a metadata filter on every query, one tenant can retrieve another's chunks.
If embeddings from multiple tenants share an index without a metadata filter on every query, one tenant can retrieve another's chunks.
Anything you can write that later gets embedded becomes a stored injection that fires whenever a similar query retrieves it.
The real attack surface of an agent is the content it ingests, not the chat box; plant instructions in data it will retrieve.