There is a particular kind of software failure that has haunted engineers since long before our current AI era. In 1985, the Therac-25 radiation therapy machine began delivering lethal overdoses to cancer patients. When investigators went looking for the responsible line of code, nothing in particular stood out. Each routine looked reasonable on its own; the failure was in the interaction between them. Ultimately the root cause was traced to a race condition that emerged only when an experienced operator edited the prescription faster than the machine's state could settle. No single if was wrong, but the complex, real-world interplay was catastrophic.
Nancy Leveson and Clark Turner's investigation into "the worst series of radiation accidents in the 35-year history of medical accelerators" is a canonical study of how individually correct parts can compose into a broken system.
Four decades later, the most dangerous vulnerabilities in AI-native software have exactly the same shape. They are not missing patches or hardcoded secrets. Static analyzers and scanners are built to catch those, and they largely do. The really thorny issues are emergent properties of novel systems. And they are precisely what Openlayer asked Octane to look for.
Sitting at the center of the AI stack
Openlayer gives teams the ability to measure, trace, and trust AI models’ behavior in production. The multi-tenant platform holds prompts, production traces that often contain sensitive end-user data, datasets, and a broad set of stored credentials. Over a hundred customer workspaces share that infrastructure. In such an architecture, tenant isolation is the invariant everything else is built on.
Openlayer secured it the way rigorous teams do, with Dependabot, code and secret scanning, AWS vulnerability detection, and an annual third-party penetration test. As far as industry standards go, that is a serious, defense-in-depth posture.
But it wasn’t enough.
Why good tools still missed the most serious bug
"Candidly," Openlayer's Co-Founder & CTO Rishab Ramanathan told us, "none of our other tooling was built to continuously reason about multi-tenant permissions across hundreds of endpoints the way Octane does. If an endpoint looks correct in isolation, scanners will pass them every time. Octane interrogates how they really interact."
A scanner evaluates code the way a proofreader checks spelling: token by token, rule by rule. It cannot hold an entire multi-tenant authorization model in its head and ask how this handler, correct on its own, interacts with an invariant three files away. A human reviewer can, in principle, but not actually in practice across hundreds of endpoints, on every PR, forever. And a pentest is a photograph: sharp, accurate, and out of focus as soon as the next commit is pushed.
The finding even pentests missed
Deep in the platform's model-execution layer, one code path authenticated to a cloud LLM provider by setting a credential in a process-wide location, then building the client without explicitly passing that credential. On a worker dedicated to a single tenant, this is invisible and harmless. But these workers are reused across tenants, so a later request from a different tenant can simply inherit the previous tenant's credential, and then execute under the wrong tenant's account. This would result not just in misbilling, but also in one tenant's prompts and outputs appearing in another's provider logs.
.png)
Octane flagged it with full context and a working exploitation scenario, and Openlayer shipped a fix within days.
While the stakes differ, the shape is identical. This is the Therac-25 pattern, reborn in the age of the LLM.
A sign of the times
Our recent analysis of AI-native codebases shows that authorization is the dominant risk vector for this entire category of software. Cross-tenancy and access-control flaws lead the distribution by a wide margin.
The reason for this is structural. AI-native platforms compose multi-tenant infrastructure, per-tenant credentials, shared execution workers, and background pipelines in configurations that have no precedent and no real playbook. Every novel system builds an attack surface that legacy tooling has never been trained to map because the surface did not exist when the tooling was designed.
Find your vulnerabilities before someone else does
If your security stack is dependency scanning plus an annual pentest, you have coverage for the last decade's vulnerabilities and a major blind spot for this one's. Point-in-time procedures produce point-in-time confidence. Continuous, reasoning-driven analysis is the only thing that keeps pace with software that is still inventing itself.
Octane is the AI security standard for mission-critical software. It hunts through your codebase with an adversary’s intent but none of their constraints. Where an attacker has to probe blind, guessing at a system they can't see, Octane ingests the whole source directly: working through every path, on every pull request, reasoning about intent and exploitability rather than simply matching patterns.
Read between the lines with Octane’s agentic security analysis. Book your demo today.
Subscribe to our newsletter
