I source-reviewed 200+ self-hosted AI tools for tenant isolation. 78 leaked across tenants.

Short summary

A systematic source review of 200+ self-hosted multi-tenant AI and SaaS products found 78 with cross-tenant data exposure, nearly all sharing the same pattern: authorization checks enforced on write endpoints but skipped on neighboring read endpoints. The author calls these 'un-retrofitted read siblings' and confirmed each finding by standing up isolated instances with synthetic canary data. 31 findings are filed as GitHub Security Advisories, with the rest under coordinated 90-day disclosure.

• •78 of 200+ reviewed multi-tenant AI products leak data across tenants via missing read-path authorization checks
• •The recurring bug pattern: ownership checks on write endpoints but not on sibling read/list/search endpoints
• •31 findings filed as GitHub Security Advisories; remainder under coordinated 90-day disclosure

Generated with AI, which can make mistakes.