⚡ Breaking - Retail AI leaks sensitive data to unauthorised users

📰 BREAKING

A production AI assistant at a national retailer exposed customer purchase histories and payment details to shoppers who shouldn't have seen them. The agent, deployed to handle order enquiries, failed to enforce row-level permissions when retrieving records from the CRM. One customer service query returned data belonging to dozens of others. The breach went undetected for three weeks until a customer reported seeing another person's transaction log in their chat window.

The gap wasn't the model. It was the operational control layer around it—the unsexy work of scoping queries, validating entitlements, and logging retrieval events before anything reaches a user. Pilot environments don't surface this class of failure because access controls are either stubbed out or manually supervised. Production does, especially in retail and banking where agent queries touch millions of regulated records daily.