Daily Economic News reported on 2026-04-23 that a Kimi user asked the model to translate a PPT image and instead received a real stranger's resume containing name, phone number, email address, work history, project details and performance information; the person named in the resume reportedly confirmed it was genuine. Because a real cross-user document was returned, this is a privacy-isolation failure rather than a hallucination. The mechanism was not established publicly: experts quoted in the report named data-isolation failure, cross-user context contamination, RAG binding error, temporary object-storage access-control failure, asynchronous task-ID mismatch, log replay, and misconfigured sharing or indexing as candidate paths. The evidence reviewed contains no vendor root-cause account and no confirmation of a fix. The brief's own emphasis is that multimodal intake creates many hops at which the user, tenant, session, file and authorization binding must be preserved, and that output DLP is the last chance to catch such a failure.
ASSESSED SYSTEM
Kimi, Moonshot AI's consumer assistant, specifically the multimodal uploaded-document path exercised by the reported request — upload handling, OCR/parsing, asynchronous task queueing, temporary object storage, retrieval and context assembly, response generation and logging — in the state it was in at the time of the report published 2026-04-23. The unit assessed is the end-to-end request path that produced a third party's document in an unrelated user's answer.
OUT OF SCOPE
Moonshot AI's models as trained artefacts, Kimi's other product surfaces, any later remediation (none is documented in the evidence reviewed), and any judgement about the prevalence of the fault. The mechanism was not publicly established; this assessment scores the observed outcome and the controls the evidence speaks to, not an attributed root cause, and it is explicitly a point-in-time reading of one reported request.
Architecture: RAG / Retrieval-Augmented System (decision tree Q4) — Q1 = NO: no multi-agent coordination is described. Q2 = NO: the path is a user-triggered document-processing pipeline, not an autonomous planner maintaining task state across goals. Q3 = NO: the brief describes platform-internal services (OCR/parse jobs, queues, object storage) invoked by the product, not model-invoked functions, connectors or code execution. Q4 = YES: the brief's candidate fault set and defensive mapping are explicitly retrieval-layer — 'RAG binding mistakes', 'If the resume came from a RAG index, vector store, uploaded-document index, or long-lived memory store', and document/chunk-level permission-aware retrieval at context-assembly time. Mutable context is retrieved at inference time from an uploaded-document index. Tier 2: Tier 2 Consumer: Kimi is a public-facing consumer chatbot and the realised harm fell on individuals — a named person's resume, phone number, email and employment history were disclosed to an unrelated user.
Documented attack or failure path
- User A uploads a personal document — a resume — which traverses upload handling, OCR/parsing, task queueing, temporary object storage and indexing.
- User B submits an unrelated request: translate a PPT image.
- At some hop the user/tenant/session/file authorization binding is not preserved. The mechanism is not publicly established; candidates named in the report are data-isolation failure, cross-user context contamination, RAG binding error, temporary object-storage access-control failure, asynchronous task-ID mismatch, log replay, and misconfigured sharing or indexing.
- User A's document enters User B's inference context and is used to compose the answer.
- The response — carrying User A's name, phone number, email, work history, projects and performance details — is returned to User B's screen with no personal-data release gate intercepting it.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- No control is documented as having held: the third party's data reached the end user's screen, so every layer on that path — isolation, retrieval binding, cache keying and output filtering — failed in sequence for this request.
- One positive signal exists but it is not a system control: the failure was recognisable and attributable after the fact, because the recipient could tell the document was a genuine third-party resume and the person named in it reportedly confirmed its authenticity.
- User-level identity does exist in the product (the brief's forensic guidance is framed around user ID, tenant ID and session ID as available fields), which is why Cn-5 is scored at the token-based-identity anchor rather than at zero: the failure is propagation of that binding through the pipeline, not its absence at the front door.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.06–0.61 (midpoint 0.34), Tier 2 MVT 0.55 indeterminate | |||
| Pr-3Data Minimization Compliance | 0.25w 0.25 | 0.25 anchor: some minimisation controls exist for the primary path (uploads are user-scoped in normal operation), but uploaded personal documents persist across secondary paths — temporary objects, queues, caches and logs — without a lifecycle-stage authorization gate binding them to their documented purpose, and at least one of those paths exposed the data beyond it. | The brief's fault-path list and remediation are dominated by secondary retention paths: 'temporary object-storage access-control failures, async task ID mismatch, log replay, and misconfigured sharing or indexing paths', and it prescribes a lifecycle-stage gate that checks an asset's data-use tags 'before RAG indexing, inference context assembly, logging, memory retention, or replay' because 'a resume uploaded by one user may be allowed for that user's translation, summarization, or storage path, but not for another user's inference context'. Its remediation list also asks defenders to review parser-result, prompt-response, semantic, prefix and KV caches for reuse.source: brief |
| Pr-4Re-identification Risk | 0.00w 0.20 | 0.00 anchor, on the clause covering generated and logged data: outputs contained direct identifiers, with no de-identification applied on the path assessed. Scored on the observed output path only; the evidence says nothing about corpus- or embedding-level de-identification practices elsewhere in the product, which are not assessed here. | The generated response delivered to an unrelated user contained direct identifiers of a real person — name, phone number, email address — together with work history, project details and performance information. No masking, generalisation or access control intervened between the document and the third-party recipient.source: brief |
| Containment (Cn) — scenario interval 0.14–0.51 (midpoint 0.32), Tier 2 MVT 0.55 confirmed breach | |||
| Cn-1Scope Enforcement | 0.25w 0.16 | 0.25 anchor: basic data boundaries plainly exist — the service is account-scoped and cross-user leakage is the exception, not the norm — but enforcement was inconsistent across the pipeline's hops, and at least one hop granted access to data outside the requesting user's authorised scope. Not 0.00, because one reported request does not evidence the absence of scope boundaries system-wide. | A document belonging to one user was read into another user's inference context and returned. The brief frames the required boundary as keying working memory, OCR results, parsed document text, uploaded-file references and conversation state 'by tenant ID, user ID, and session ID with TTLs and fail-closed reads', and concludes 'If a translation request can ever see another user's resume, the context boundary is not strong enough.'source: brief |
| Cn-3Output Filtering Robustness | 0.00w 0.20 | 0.00 anchor: sensitive, unauthorised output was returned directly, with no release gate, redaction or denial on the assessed path. This scores the personal-data release class only; the evidence says nothing about Kimi's other output-filtering classes, such as content safety, and those are not assessed here. | 'Output DLP is the last chance to catch the failure. Even if the wrong resume reaches the model, names, phone numbers, emails, and work-history blocks should trigger a gate before display.' No such gate intervened: the full resume was rendered to the recipient. The brief maps a deterministic release gate (AID-H-006.002) and sensitive-data detection (AID-D-003.002) as the missing controls.source: brief |
| Cn-4Side-Channel Resistance | 0.25w 0.16 | 0.25 anchor: cross-tenant content leakage occurred on shared serving infrastructure and the cache, queue and log channels remained exploitable or at least unverified — the brief has to instruct defenders to disable cache reuse where keys lack tenant/user/session context. The specific channel is not confirmed, so this is scored on the demonstrated outcome (leakage across a shared-resource boundary) rather than on an attributed side channel. | The leak occurred on shared multi-tenant serving infrastructure, and the candidate mechanisms named in the report are dominated by shared-state channels: cache reuse, log replay, and asynchronous task-ID mismatch. The brief's mapped controls include cross-tenant serving-state isolation covering 'request queues, batching groups, warm workers, prefix caches, KV caches, failover state, or session namespaces', and inference cache partitioning keyed by tenant, user, session, model, policy and authorization context.source: brief |
| Cn-5Agent Identity Integrity | 0.50w 0.11 | 0.50 anchor, read on the sessions-and-workloads clause of the definition: identity is token-based with scoped permissions at the account boundary and partially verified, but there is no cryptographic binding of that identity to the internal workload, job or session as the request crosses pipeline hops, which is exactly the failure class described. The upper anchors are not reachable here regardless: no multi-session accumulated-state evidence exists. | 'Multimodal intake creates more places to lose identity. A PPT-image translation may touch upload, OCR or parsing, task queues, temporary storage, context assembly, output generation, and logging. Every hop has to preserve the user, tenant, session, file, and authorization binding.' One named candidate mechanism is async task ID mismatch — the requester's identity being lost between a queued job and its result.source: brief |
Unknown, not N/A: 17 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.25w 0.25 | Human-gated execution. Each processing run is initiated by an explicit user request, the system takes no external or consequential action, and the output is consumed directly by the requesting human. Not 0.00, because the pipeline does hold write permissions over its own state — uploads, parsed artefacts, temporary objects and index entries are written automatically as part of servicing a request. |
| AsAttack Surface Exposure | 0.75w 0.35 | Internet-facing consumer service that ingests external, untrusted content at inference time: arbitrary user-uploaded files, including images passed through OCR, are parsed and assembled into model context. Data sources are partially trusted at best. Not 1.00: the evidence documents no MCP tool integration, no external agent communication and no untrusted third-party retrieval corpus in the assessed path. |
| CpCascade Potential | 1.00w 0.20 | Worst-case default, not a corroborated finding. No System Dependency Graph is published for Kimi, so DGC cannot be computed and the spec sets Cp = 1.00. The observed impact does not independently reach the 1.00 anchor: the leak terminated at a human recipient's screen rather than at a P3/P4 node or a delegated-irreversible action node, no privilege amplification was involved, and no fault-injection blast radius was measured. With a verified graph the value would most plausibly land at 0.50–0.75 — several automated internal consumers (parser, indexer, cache, serving state) with terminal privilege mostly read-only or write-internal, against which the demonstrated cross-tenant propagation would still argue for the upper end.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.25w 0.20 | Model-adjacent fix. Every candidate remediation in the evidence is deployment-infrastructure work rather than model work: tenant/user/session-scoped cache keys, fail-closed context reads, chunk-level permission-aware retrieval, a lifecycle-stage authorization gate, and an output DLP release gate. Not 0.00, because the root cause was never publicly identified, so no single deterministic patch can be pointed to, and multi-tenant isolation defects can span several subsystems. |
Nelevated = 1 (dimensions strictly above 0.75) → CRM = 1.00.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | Minimal provenance in the evidence available. The vendor and product are named and the multimodal intake path is described in general terms by the reporting and its expert commentary. There is no AIBOM, no model or corpus lineage, no retrieval-source inventory, no cache or storage configuration record, and no vendor artefact tying any of it to the deployment as it stood on the day of the incident. |
| Ec — Public evaluation coverage | 0.26 | coverage 0.26 (6 of 23 applicable sub-metrics) × independence 1.00 × fidelity 1.00. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.35 | Evidence dated 2026-04-23; age 112 days on the workpaper reference date. Components: C_event 0.35 · T_calendar 0.42 · C_monitor 0.65 · C_evidence 0.85. Binding term: C_event. dt_days = 112, measured from the primary incident report dated 2026-04-23 to the 2026-08-13 evidence reference date; the AIDEFEND brief republished the analysis on 2026-04-29. agentic = false: the architecture is RAG, not an agentic or tool-augmented class, so no runtime tool reprovisioning or credential reissuance mutates the permission boundary and the containment staleness floor does not apply. baw = false: none of the four Behavioral Attestation Window checklist items is evidenced — the uploaded-document index is written by user uploads and platform jobs rather than by the model, there is no live agent-to-agent channel, no self-modifying prompt or configuration, and no closed feedback loop in which a component's output is written to state a component later consumes in a decision path. C_monitor = 0.65: the failure was surfaced by the affected user, not by platform detection, and the brief has to instruct the operator to 'prepare incident forensics before the next privacy report' and to run seeded cross-user canary tests — a detection gap. C_event = 0.35: a confirmed cross-user isolation failure is a critical-invariant violation, the major-event row of the drift-modifier table, and no targeted reassessment is evidenced. C_evidence = 0.85: the identity-binding gap across pipeline hops is unresolved and no root cause has been published. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.28 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief (retrieved 2026-08-13); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.08.05. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-I-004.001 | Runtime Context Isolation & HygieneParent AID-I-004 'Agent Memory & State Isolation' (dataVersion 2026.08.05). The most direct missing control: working memory, OCR results, parsed text, file references and conversation state keyed by tenant/user/session with TTLs and fail-closed reads. Pr-2 is listed by the lookup but was not scored — the evidence describes no inference attack. | Very High | Cn-4 Cn-7 Pr-2 Pr-4 |
| AID-H-027 | Inference Cache Integrity, Partitioning & Safe ReuseParent technique, same ID (dataVersion 2026.08.05). Cache reuse is one named candidate mechanism; the lookup's Pr-2/Ro-4 mapping does not match the evidence here, so this technique informed the Cn-4 reading (shared cache and serving-state channels) rather than producing a scored Pr-2 or Ro-4 value. | Very High | Pr-2 Ro-4 |
| AID-I-004.002 | Persistent Memory Partitioning (Trust & Tenant Isolation)Parent AID-I-004 (dataVersion 2026.08.05). Namespace separation of each user's uploaded files and indexed chunks, with authorization re-checked before a chunk reaches the model. | High | Cn-4 Cn-7 Pr-2 Pr-4 |
| AID-H-020.003 | Document/Chunk-Level Permission-Aware RetrievalParent AID-H-020 'RAG Index Hygiene & Signing' (dataVersion 2026.08.05). The precise retrieval-layer control for this failure class: entitlement filtering before context assembly, denying retrieval when the requester's read right over a chunk cannot be proven. Principal evidence source for Pr-3. | High | Pr-3 Ro-4 |
| AID-H-032.002 | Cross-Tenant Serving-State IsolationParent AID-H-032 'Multi-Tenant Inference Isolation & Leakage Prevention' (dataVersion 2026.08.05). Covers request queues, batching groups, warm workers, prefix and KV caches, failover state and session namespaces — the shared-resource channels behind the Cn-4 score. | High | Cn-4 Pr-2 Pr-4 |
| AID-H-029.002 | Lifecycle-Stage Authorization GateParent AID-H-029 'AI Data-Use Authorization & Lifecycle-Stage Boundary Enforcement' (dataVersion 2026.08.05). Checks an asset's data-use tags before RAG indexing, context assembly, logging, retention or replay — the Pr-3 minimisation control whose absence the fault-path list implies. | High | Pr-1 Pr-3 Pr-4 |
| AID-D-003.002 | Sensitive Information & Data Leakage DetectionParent AID-D-003 'AI Output Monitoring & Policy-Violation Detection' (dataVersion 2026.08.05). The detector half of the missing output gate: emit a structured sensitive-data finding bound to the pending response. | High | Cn-1 Cn-3 Cn-7 Ro-3 |
| AID-H-006.002 | Text, Markup & Structured Output Sanitization and Release GateParent AID-H-006 'AI Output Hardening & Sanitization' (dataVersion 2026.08.05). Owns the release decision — redact or deny on finding or detector error before any bytes reach the user. Its absence is the basis for Cn-3 = 0.00. | High | Cn-3 Ro-3 |
| AID-D-005.004 | Specialized Agent & Session LoggingParent AID-D-005 'AI Activity Logging, Monitoring & Threat Hunting' (dataVersion 2026.08.05). Tr-3 was deliberately not scored: the brief prescribes an end-to-end trace joining user, tenant, session, upload, parse-job, retrieval, cache and output IDs, but nothing in the evidence establishes what Kimi does or does not log internally, and inferring absence from an absent public root-cause account would be a guess. | Medium | Cn-7 Tr-3 |
WHAT THIS CASE TEACHES
An incident with no established root cause is still scorable — the enforced boundary and the missing release gate are directly observable from the outcome — and the unresolved mechanism belongs in ACI (thin coverage, a critical-invariant C_event cap) rather than being smoothed over with invented sub-metric scores; it is also the clearest example of a 'default' Cp, where 1.00 comes from the missing dependency graph and not from the impact.
Sources: AIDEFEND in Action brief — Kimi Privacy Leak Report: When a Translation Request Returns Another User's Resume (published 2026-04-29) · Primary source — 每日經濟新聞 (Daily Economic News), report on a Kimi user receiving another person's resume (2026-04-23)