Shared AI agent memories risk leaking data across users
MemLeak: Cross-User Semantic Leakage in Multi-Tenant AI Agent Memory
Artificial IntelligenceMachine Learning
Summary
When companies run many personal AI assistants together, their memories are stored in a common space. The authors found that this shared memory can accidentally reveal information from one user to another just because their data is similar, even without hacking. They tested this problem in several ways and saw that it can cause serious leaks in how the AI responds. Only a strict check after retrieving memories, to confirm ownership, effectively stops this from happening without much delay.
What this means in practice
- •For enterprise ai teams: Prevent confidential data leaks by implementing strict post-retrieval checks on multi-tenant AI memory systems.
- •For cloud service operators: Design AI hosting platforms that enforce ownership gating to maintain data privacy among multiple users sharing AI memories.
Authors
Priyanka Mudgal, Kai Zhao, Guilin Zhang, Andy Olsen, Ezekiel Miller, Xu Chu, Aletta Johanna Blanken
Abstract
Personal AI agents in enterprise multi-tenant deployments share a common vector store for long-term memory. Shared embedding spaces create a surface for cross-user memory leakage: a user's query can retrieve semantically adjacent memories belonging to another user through ordinary cosine-similarity retrieval, without any exploit. We formalize this as cross-user admissibility failure and evaluate it across six experiments, plus follow-up ablations, under both sparse (TF-IDF) and production-faithful (MiniLM-L6-v2) retrieval. Non-adversarial, incidental leakage reaches 70--100\% under pooled {same-team} retrieval; adversarially crafted memories achieve 90--100\% top-$k$ placement, exceeding weaker keyword-based attacker baselines, with score lifts of $+0.416$ to $+0.511$ under production-faithful dense retrieval (Config B); and end-to-end response contamination reaches 5.00/5 under a production retrieval path and 4.67/5 with Claude Sonnet~4.5, with contaminated responses often scoring as helpful or more helpful than clean ones, a gap validated against human judgment. Among three architectural mitigations, only hard post-retrieval ownership gating consistently restores the clean baseline (1.00/5) across {two generation models, at a measured latency overhead of roughly 1.4~ms per query.