The report
Three recent AI-platform disclosures have the same operational symptom: an authenticated requester can make the service act on the wrong user's state or credentials. Their underlying defects differ, which matters when choosing a fix. Adding another login challenge would not repair any of the three.
Three distinct failures
| System | Trust boundary lost | Demonstrated or reported consequence |
|---|---|---|
| LangGraph JS Store | An authorization callback rewrote the namespace, but execution later used the original request | Cross-user Store read, search, write or delete when applications depended on rewrite-style authorization |
| Mem0 | Unescaped separators made different agent, run and user tuples serialize to the same session key | Conversation history could be mixed across scopes and fed into memory extraction |
| Red Hat AI gateway | Model selection was not reliably bound to the requesting tenant | A request could use another tenant's provider key for inference or billing |
In LangGraph, the advisory narrows the issue to JavaScript or TypeScript applications using a custom handler that rewrites a namespace. Handlers that reject requests outright and the Python implementation take different paths. In Mem0, the reported collision arises before model reasoning, when a storage key is constructed. Neither case needs a malicious prompt to explain the authorization error.
For Red Hat, the advisory describes use of another tenant's gateway credential, not necessarily disclosure of the plaintext key. Affected deployment versions and real customer exploitation were not independently established in this review.
What should be checked after a fix
A useful regression test alternates two principals across each API operation and verifies the effective backend namespace, account and credential, not just an earlier policy decision. The identity used at authorization must survive serialization, storage lookup, routing and final execution unchanged. These three cases show why a green authentication result cannot substitute for end-to-end tenant isolation.