LowContext Bleed●Realized
Cross-session / cross-user context bleed
Privacy & Data ProtectionDescription
State, cache, or memory leakage causes one user's context to appear in another user's session.
Example scenario
A shared cache returns one customer's prior conversation snippet to a different customer.
Real-world evidence●Realized
GDPR enforcement actions for unlawful international data transfers are confirmed production incidents. The Court of Justice of the EU invalidated the EU-US Privacy Shield in Schrems II (2020), and DPAs have since issued substantial fines — including against Meta Ireland — for continuing to transfer data to the US without adequate safeguards. AI-specific complaints (e.g., EU DPA investigations into ChatGPT data routing) have also been opened.
Primary mitigations
- Strict session isolation
- per-user memory scoping
- cache keying by identity
- isolation testing.
Detection signals
Cross-session leakage tests; cache-key audits; session-isolation red-team.
Mitigating controls
4 Non-agentic controls