No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents

Understand

LLM-based agents increasingly operate across repeated sessions, maintaining task states to ensure continuity.

• In many deployments, a single agent serves multiple users within a team or organization, reusing a shared knowledge layer across user identities.
• This shared persistence expands the failure surface: information that is locally valid for one user can silently degrade another user's outcome when the agent reapplies it without regard for scope.
• We refer to this failure mode as unintentional cross-user contamination (UCC).