Shared-State Cross-User Contamination

Properties

family: context-rot
severity: systemic
triggerError: A benign user interaction produces a scope-bound artifact (interpretation, transformation rule, or workflow) that persists in a shared agent state layer.
mechanism: When a subsequent user queries the same shared-state agent, the agent silently reapplies the prior user's artifact without scope-checking, producing a silent wrong answer; no adversary is required and the contamination rate reaches 57–71% under raw shared state.
blastRadius: All users served by the same shared-state agent instance; each contaminating interaction raises the probability of corrupting subsequent users, compounding across the user population.
mast: [Cat 1][Cat 3]
detection: Divergence between a user's explicit query intent and the agent's response; monitoring for artifact reuse across user-session boundaries; A/B comparison against an isolated-state baseline.
mitigation: Write-time sanitization (Sanitized Shared Interaction) that strips user-specific scope before persisting artifacts; per-user context isolation; scope tags that prevent cross-user artifact reuse.
source: No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents (arXiv:2604.01350)

family: context-rot
severity: systemic
triggerError: A benign user interaction produces a scope-bound artifact (interpretation, transformation rule, or workflow) that persists in a shared agent state layer.
mechanism: When a subsequent user queries the same shared-state agent, the agent silently reapplies the prior user's artifact without scope-checking, producing a silent wrong answer; no adversary is required and the contamination rate reaches 57–71% under raw shared state.
blastRadius: All users served by the same shared-state agent instance; each contaminating interaction raises the probability of corrupting subsequent users, compounding across the user population.
mast: [Cat 1][Cat 3]
detection: Divergence between a user's explicit query intent and the agent's response; monitoring for artifact reuse across user-session boundaries; A/B comparison against an isolated-state baseline.
mitigation: Write-time sanitization (Sanitized Shared Interaction) that strips user-specific scope before persisting artifacts; per-user context isolation; scope tags that prevent cross-user artifact reuse.
source: No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents (arXiv:2604.01350)