How to Stop Agentic AI From Leaking One Tenant's Data to Another

As enterprises deploy LLM-based agents with access to tools and real data, a critical security risk emerges: the 'confused deputy' problem, where manipulated input tricks an agent into using its credentials on behalf of the wrong tenant. Unlike traditional code exploits, these attacks work through ordinary text — a poisoned document or crafted support ticket can instruct the agent to exfiltrate data. Effective defenses include treating all user input as hostile, enforcing row-level database isolation tied to an auth service, and scoping credentials narrowly with least-privilege, short-lived tokens per workflow. Security must be enforced in code and database policy, not in system-prompt instructions, which the model can be manipulated into ignoring. Extensive logging and anomaly detection on cross-tenant patterns are also recommended, so that when an injection does succeed, the damage is limited to a single request.