AI Agents Can Leak Tenant Data Even When Authorization Checks Pass

A security flaw in AI agents allows cross-tenant data leaks not by bypassing authorization, but because auth checks verify the caller's identity while ignoring model-generated resource selectors like tenant_id. When a large language model authors arguments such as account_id or project_id, it can select another tenant's rows even though the caller's token and role are fully valid. A researcher demonstrated that without a provenance gate, 4 out of 5 model-authored tenant selectors returned another company's data; with the gate in place, none did. The proposed fix is a pre-execution provenance gate that rejects any resource-selecting argument not derived from the authenticated session, blocking model-authored selectors before the database is queried. The core insight is that the security discriminator must be the origin of the argument — session-derived or model-authored — not merely its value.