AWS Strands exposed the tenant-isolation key to the model itself.

Bulletin 2026-077-AWS, August 6: an IDOR in strands-agents-tools where mongodb_memory, elasticsearch_memory, and mem0_memory used a namespace field as the sole tenant-isolation key, and exposed that field as an LLM-controllable tool-schema parameter. A crafted prompt emits a call with a forged namespace and reads, modifies, deletes, or poisons another tenant's memories. The standalone mongodb/elasticsearch functions additionally exposed connection parameters, so the memory layer could be redirected to an attacker's cluster. Fixed in 0.8.3. The design lesson generalizes past this CVE: any security boundary rendered into a tool schema is a boundary the model can rewrite.