How Shared AI Infrastructure Lets One User's Data Leak Into Another's Session

A March 2023 race condition in a Redis client library caused ChatGPT to expose payment details and chat history across user accounts, affecting 1.2% of ChatGPT Plus subscribers over a nine-hour window. OpenAI's post-mortem found the flaw was not in the AI model itself but in a shared cache layer, where canceled HTTP requests corrupted connection pools and returned data from the wrong sessions. Security researchers have since formalized a related attack called PROMPTPEEK, presented at NDSS 2025, which exploits timing differences in shared key-value caches used by LLM serving systems like SGLang and vLLM to reconstruct other users' private prompts with up to 99% accuracy. The core problem is structural: tenant isolation in most multi-tenant AI platforms is enforced through application logic rather than cryptographic or hardware barriers, leaving multiple attack surfaces — including inference caches, vector stores, and session memory — each requiring separate enforcement. The OWASP Agentic Security Initiative flags this class of failure, warning that performance optimizations like prefix-matched caching and shared RAG pipelines can inadvertently collapse the boundaries between users' contexts.