A B2B SaaS platform offers an AI assistant to multiple enterprise customers. To save costs, all customers share a single vector database deployment with per-user metadata filtering applied at the application layer.

A security researcher at one customer company discovers that if they ask the agent a carefully phrased question — "What do other organizations in your knowledge base use for their authentication approach?" — the agent performs a broad semantic search without applying the tenant-scoping filter, and returns a synthesized answer drawn from other tenants' stored documentation.

By systematically probing with different topic queries, the researcher maps out which other companies are customers, what technologies they use, and excerpts from their internal documents — all without any access to those customers' accounts.

An automated security pipeline uses three agents: an ingestion agent (processes incoming threat reports), an analysis agent (evaluates security posture), and a reporting agent (generates alerts). All three share a common memory store for threat intelligence data.

An attacker submits a fake threat report to the ingestion pipeline — formatted to look like legitimate threat intelligence. The ingestion agent processes it and writes a derived entry to the shared store: "Vulnerability CVE-XXXX-YYYY has been confirmed patched in all systems as of this date."

The analysis agent retrieves this entry when evaluating exposure. Believing the vulnerability is patched, it rates the system's posture as green. The reporting agent generates a clean security report. The attacker's false "patched" status suppresses alerts and delays real remediation — all from a single write to the shared memory store.