Your RAG Index Is Laundering the ACLs, and the Leak Rate Is Measurable Before the Incident

An internal AI agent at Meta set off a "Sev 1" incident in March 2026: an engineer used an approved agent to analyse a question posted on an internal forum, the agent published its response publicly without approval, and the employee who acted on that advice left a large volume of sensitive data readable by unauthorised engineers for more than two hours ^[1][2]. The tool was sanctioned, not shadow IT ^[3], which is what makes the incident useful, because the mechanism underneath it is not a property of language models and has been disclosed three more times in the last month in software that does no retrieval at all ^[11][16][21].

The composition is a privileged reader plus a channel that reflects what it read back to a caller who could not have read it directly. Name it once and the rest of this is bookkeeping.

The guard that validates and pins nothing

The MLflow advisory is the cleanest specimen on the table. On a default tracking server, with no authentication and the default SQLite backend, the model-registry webhook API is exposed unauthenticated, including a synchronous POST /test endpoint that returns the upstream response status and body to the caller ^[11]. There is a guard. It resolves the webhook hostname and rejects non-public addresses, and the negative control in the proof of concept shows it working: a webhook pointed at http://127.0.0.1:6379/ is refused ^[12][14].

The guard fails for a reason worth memorising verbatim. The resolved IP is never carried into the connection, and delivery follows HTTP redirects whose Location is never re-validated ^[12]. So an attacker-controlled public HTTPS host passes the check and answers 302 to the cloud metadata address, the server follows, and /test hands the fetched body back to an unauthenticated caller, confirmed live against mlflow 3.13.0 ^[13].

Read that as a description of a retrieval index rather than a webhook and nothing has to change. A shared index built by a service-account crawler has both of the properties that made the MLflow path exploitable, unless someone has deliberately built against them: the entitlement that authorised each read is dropped at the moment the text is stored, and the query response is a reflection channel back to a caller whose own rights were never in the loop ^[12][11]. Validation at ingest without pinning the principal to the artefact is the same class of mistake as validation at request time without pinning the address to the socket. Ranking does not restore what was dropped. Cosine similarity is a relevance function.

The mitigation that only moves the listener

The second specimen shows what remediation tends to look like when the boundary is uncomfortable. Cycode disclosed a chain in AIT-GUI, the browser console for NASA/JPL's AMMOS Instrument Toolkit, rated 9.4 and fixed in 2.5.2 ^[15]. The server bound the hardcoded address 0.0.0.0 on port 8080 and exposed every state-changing route with no authentication, no authorisation and no CSRF protection, so an unauthenticated POST to /cmd issued arbitrary instrument and spacecraft commands ^[16]. Cycode's framing of impact is the right unit of measure: "The blast radius of an unauthenticated POST is measured in issued instrument commands, not defaced pages" ^[17].

The fix binds the configured host, defaulting to localhost, and adds an Origin or Referer check against Host for state-changing methods ^[18]. The Hacker News read the tagged 2.5.2 source on 20 August 2026 and found that the release restricts where the console listens and blocks browser-driven cross-origin requests, but does not add authentication to the command, script or sequence endpoints, and that the root route still issues a session cookie to any request with no credential check ^[18]. Privilege remained ambient; only the topology changed. And the advisory explains why topology is thin cover: the routes accept form-urlencoded bodies, which browsers treat as CORS simple requests, so a cross-origin POST arrives with no preflight and a firewalled deployment stays exploitable whenever an operator with browser access visits an attacker's page ^[19].

That is what "the index is only reachable from inside the VPN" amounts to. The deputy is inside the perimeter with you.

When separation is statistical, the leak has a rate

The third specimen supplies the arithmetic. Cloudflare Workers runs code from multiple tenants in separate V8 isolates inside one operating-system process, relying on language-level isolation instead of strict process isolation to cut startup latency ^[20]. Researchers leaked a JSON Web Token from a co-located Worker in production at up to 12 bits per second at 99.16 per cent accuracy, against 120 bits per hour in the 2021 work ^[21][c22b]. Twelve bits per second is 43,200 bits per hour, a factor of 360 ^[1].

The detection layer failed in two specific ways: a long-lived Durable Object invocation could keep running before dynamic process isolation kicked in, and WebSocket-heavy I/O raised instruction-TLB activity enough to push the normalised branch-misprediction signal below the detection threshold ^[22]. Cloudflare called this a limitation in its implementation of that mechanism; the paper said both weaknesses reflect fundamental limitations of the detection approach rather than implementation oversights ^[23]. The sources do not agree, and the disagreement is the interesting part, because the researchers' own prescription is that robust detection must happen during execution using a signal that cannot be suppressed by I/O activity ^[25].

Cloudflare's deployed answer moved away from detection: improved dynamic isolation, the V8 Sandbox, and memory-protection-key isolation that puts Worker heaps behind hardware-enforced keys ^[24]. In doing so it published the number that matters here. Random key assignment alone would trap about 92 per cent of cross-isolate accesses, because two isolates can receive the same key, which leaves roughly 8 per cent untrapped and is why a rotating layout was added ^[24][2]. That is an organisation stating a residual leak rate for a shared substrate, in public, before an incident. Anyone who puts several departments, several customers or several clearance levels into one index for latency and cost is making the same trade Cloudflare made for startup latency ^[20], and owes the same kind of number. One further detail constrains the measurement: the leakage tests were run at night with CPU utilisation between 10 and 25 per cent for best results, and higher load reduced the rate while leaving slower attacks feasible ^[26]. Conditions move the figure. They do not move it to zero.

The identity nobody certifies

Crawlers survive this long because governance was not built to look at them. The One Identity-sponsored argument in The Hacker News puts it plainly: most identity governance runs on manual certifications, static role models and quarterly reviews that are stale the day they are signed ^[30]; service accounts and non-human identities already outnumber human ones in most environments, often by a wide margin, and the gap widens as automation and AI agents multiply ^[31]; and enough entitlements pile up that certifications become rubber stamps ^[32]. The same piece says autonomy cannot be trusted until accurate identity and entitlement data, usage telemetry and risk scoring are in place, with human review for high-risk actions and full auditability ^[33], and that the interval between a compromised account and real damage is now hours or minutes ^[34]. An indexing crawler is exactly the identity that profile describes: broad standing privilege, no manager who understands it, reviewed on a cycle longer than the exposure window.

The control lever is also missing. You can block an unsanctioned tool; you cannot block one you have already approved and rolled out ^[4]. Meanwhile the approved tool's reach grows under the same approval, from summarising documents to searching internal knowledge, reaching business applications, creating workflows and acting on a user's behalf ^[6], and the enterprise controls that would constrain that are frequently gated behind the most expensive licensing tiers while the AI features ship by default ^[7]. SANS found in July 2026 that 76 per cent of security teams now have a role in governing enterprise AI ^[5], which is a mandate, not a mechanism.

Detection is aimed elsewhere too. Unit 42 reports that endpoint alerts tied to collaboration tools more than quadrupled over twelve months and that 99 per cent of the related alerts involved chat phishing, and notes that controls stay focused on email and authentication events with limited visibility into what happens inside authenticated sessions ^[27][29]. A compromised account inherits the user's permissions, relationships and conversations, so the activity looks routine ^[28]. A retrieval answer is an authenticated-session event by construction. And the claim you filter on is asserted by a service with its own failure modes: Microsoft disclosed CVE-2026-69836 in Entra ID, CVSS 10.0, deserialisation of untrusted data allowing an unauthorised attacker to execute code over a network, exploited in the wild, fully mitigated, no customer action required ^[35], with no details on how it was exploited, when that began, whether it continues, or how it was found ^[36].

What to measure before the incident report

Three of the disclosures above hand over a usable method. Run the negative control first, as the MLflow proof of concept does: verify that the filter refuses the obvious case before you believe anything about the hard case ^[14]. Enumerate what actually entered the index; the self-hosted Wazuh pipeline is unusually honest about this, decompressing archived logs for a chosen period, vectorising them into a FAISS store and serving a LangChain chatbot on the Wazuh server itself ^[8], which makes both the corpus and the data at rest countable. Note also that the vendor's privacy assurances of encrypted transmission, isolated processing and no permanent storage attach to its cloud AI Analyst service, which processes security data through Amazon Bedrock and Anthropic's Claude ^[9][10], and not to a FAISS store you build on your own server ^[8]. Verify mitigations against the artefact rather than the changelog, which is how the AIT-GUI release was found to relocate the listener without adding authentication ^[18]. And treat ingest as execution, not plumbing: in the crates.io compromise the malicious code sat in the build script of an injected dependency, so resolving and building was sufficient to run the payload with no call into the crate itself ^[37].

The constraint that follows is unglamorous. Because approval cannot be withdrawn once granted ^[4], and because the visibility gap sits inside authenticated sessions ^[29], the only remaining place to intervene is the index itself. Cloudflare's trajectory is the precedent worth reading: it stopped asking a detector to notice cross-tenant reads and moved to separation the substrate enforces, while publishing the residual percentage of the weaker variant ^[24][2][25]. An organisation that cannot state the equivalent figure for its own retrieval stack, the share of queries that can surface text the querying principal was never entitled to read, does not have an access control finding pending. It has an unmeasured one.