Enterprise RAG Systems Face Multitenant Security Risks

A recent paper on arXiv (2605.05287) highlights significant security vulnerabilities within Retrieval-Augmented Generation (RAG) and agentic AI systems used in enterprise settings. Unlike consumer or academic environments, enterprises must navigate various tenants with diverse data, stringent access regulations, compliance mandates, and cost constraints that necessitate shared infrastructure. The authors pinpoint a critical issue: retrieval systems prioritize documents based on relevance—through semantic similarity, keyword matching, or a combination of both—rather than authorization. Consequently, a query from one tenant may inadvertently reveal another tenant's sensitive information if it ranks highest. Additional issues include tool-mediated data exposure, context accumulation over interactions, and bypassing client-side orchestration, stemming from the confusion between relevance and access rights. The authors advocate for multitenant architectures that enforce access control during retrieval.