Steal the neighbor's token, get your own

Two customers, two containers, one server. Customer A's developer finds container-customer-b in a log somewhere and tries it from inside A's container.

It works: as A. The gateway doesn't parse the suffix; it resolves identity from the source address, so any container- token sent from A's address is A. B's access flag, B's prompts, B's responses: untouched. Each container's AI channel is isolated, and A can't read B's traffic any more than it can borrow B's name.

Per-customer provider keys would make this a real incident: one leaked key spends on another customer's account until someone notices. Here the leak is a string that names a container it cannot become.

Identity is where the request comes from, not what it says.