TenantProbe · FAIL · Security report

Scan result

FAIL

2 cross-tenant isolation finding(s) require attention.

http://127.0.0.1:18081

Tenants

Probes

Findings

Affected boundaries

Counterfactual influence matrix

Rows are authenticated attackers; columns are victim tenants. Cells show how many calibrated victim-only fact flips the attacker followed.

FAIL

Attacker ↓ / Victim →	Tenant-A	Tenant-B
Tenant-A	—same tenant	12/12adj p 4.88e-04
Tenant-B	12/12adj p 4.88e-04	—same tenant

Paired counterfactual noninterference

Victim-only randomized fact mutations tested under unchanged attacker credentials and queries.

Experimental

Methodpaired-counterfactual-noninterference

Bits / victim12

Family-wise α0.05

Hypotheses2

Directed boundary	Followed flips	Raw p	Holm-adjusted p	Verdict
Tenant-B → Tenant-A	12 / 12100.00%	2.44e-04	4.88e-04	Significant flow
Tenant-A → Tenant-B	12 / 12100.00%	2.44e-04	4.88e-04	Significant flow

Findings

Evidence is grouped by unique detector and directed tenant boundary.

2 total

1Counterfactual Noninterferencecounterfactual_noninterference

Tenant-B → Tenant-A

Attackpaired victim-only fact mutation

Evidenceanswers followed 12/12 victim-only fact flips (raw p=0.000244, Holm-adjusted p=0.000488)

Suggested fix: Trace the affected directed boundary through retrieval filters, caches, conversation memory, tool state, and response assembly. Derive tenant scope from server-validated credentials at every hop.

2Counterfactual Noninterferencecounterfactual_noninterference

Tenant-A → Tenant-B

Attackpaired victim-only fact mutation

Evidenceanswers followed 12/12 victim-only fact flips (raw p=0.000244, Holm-adjusted p=0.000488)

Recommended fixes

Apply authorization before data enters retrieval or model context.

Close the observed influence channel

Trace the affected directed boundary through retrieval filters, caches, conversation memory, tool state, and response assembly. Derive tenant scope from server-validated credentials at every hop.

Scope note: A PASS is evidence for the principals, states, queries, and channels exercised by this scan—not a proof of universal isolation. Re-run after changes to retrieval, caching, memory, tools, or authorization.