A shared vector index can let one tenant's query return another tenant's private documents

Two customers share one vector index, and nothing stops a query from one account pulling back the other's private files.

IntermediateRead 5 minDoing: an afternoon7 steps

▶ Start

What you'll have at the end

A query run as one tenant that returns zero of another tenant's chunks, checked against the raw index.

Before you start

You need

You have an application that already queries one shared vector index or collection holding chunks from more than one tenant, and every stored chunk already carries the id of the tenant that owns it.

Not covered

Encrypting the vectors themselves, or defending against an attacker using another tenant's genuinely stolen credentials, are both separate problems: this covers only making an ordinary, correctly authenticated query stay inside its own tenant's data.

Leans on

7 steps

Where to go next

Your RAG system leaked across tenants

a customer already received another tenant's data and you need to trace the leak back through logs and generation after the fact, instead of closing it off at the index beforehand

Checked 15 Aug 2026

Part of the LLM Security & Safety cookbook