No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents

• URL: http://arxiv.org/abs/2604.01350v1
• Date: Wed, 01 Apr 2026 20:03:56 GMT
• Title: No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents
• Abstract summary: In many deployments, a single agent serves multiple users within a team or organization, reusing a shared knowledge layer across user identities.<n>This shared persistence expands the failure surface: information that is locally valid for one user can silently degrade another user's outcome when the agent reapplies it without regard for scope.<n>We refer to this failure mode as unintentional cross-user contamination (UCC)<n>Unlike adversarial memory poisoning, UCC requires no attacker; it arises from benign interactions whose scope-bound artifacts persist and are later misapplied.
• Score: 30.33705025907034
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: LLM-based agents increasingly operate across repeated sessions, maintaining task states to ensure continuity. In many deployments, a single agent serves multiple users within a team or organization, reusing a shared knowledge layer across user identities. This shared persistence expands the failure surface: information that is locally valid for one user can silently degrade another user's outcome when the agent reapplies it without regard for scope. We refer to this failure mode as unintentional cross-user contamination (UCC). Unlike adversarial memory poisoning, UCC requires no attacker; it arises from benign interactions whose scope-bound artifacts persist and are later misapplied. We formalize UCC through a controlled evaluation protocol, introduce a taxonomy of three contamination types, and evaluate the problem in two shared-state mechanisms. Under raw shared state, benign interactions alone produce contamination rates of 57--71%. A write-time sanitization is effective when shared state is conversational, but leaves substantial residual risk when shared state includes executable artifacts, with contamination often manifesting as silent wrong answers. These results indicate that shared-state agents need artifact-level defenses beyond text-level sanitization to prevent silent cross-user failures.

Related papers

• The Agentic Company OS: Substrate Inversion for Sustained Enterprise Agent Deployment [1.2744523252873352]
  We argue that failure modes share a common architectural root: agents reason over data structured for human operators.<n>This position paper proposes that companies deploying agents in sustained operation should rebuild their cognitive substrate.
  arXiv  Detail & Related papers  (2026-09-11T09:48:43Z)
• When Collaboration Becomes a Trigger: Collective Evidence-Threshold Backdoors in Multi-Agent Systems [57.450132281381066]
  Backdoor behavior can be activated when peer evidence reaches a hidden threshold, rather than being determined by any single message.<n>We introduce a collective evidence-threshold backdoor paradigm for MAS and Boundary-Conditioned Backdoor Injection (BCBI)<n>We propose LAtent Transition Test-time Evaluation (LATTE), a clean-only latent-transition defense that learns benign communication dynamics and quarantines anomalous agent updates.
  arXiv  Detail & Related papers  (2026-08-02T08:38:44Z)
• PhyAgentOS: A Self-Evolving Operating System for Embodied Agents with Decoupled Cognitive Planning and Physical Execution [49.776611937968]
  We present PhyAgentOS, a foundation delivering scheduling, verification, memory, benchmarking, and safety as system-level services.<n>Its Session-Centered treats a session, not an action, as the minimum unit of scheduling, compatibility, supervised execution, evidence collection, and acceptance.<n>SessionVerifier distinguishes execution termination from semantic task completion via evidence-grounded verdicts of success, failure, or replan.<n> Benchmarking reuses the deployment session and verification path, so results trace to real execution.
  arXiv  Detail & Related papers  (2026-07-18T04:46:53Z)
• Capable but Careless: Do Computer-Use Agents Follow Contextual Integrity? [54.701199583505144]
  Cross-application access creates a privacy risk that has been largely overlooked.<n>We introduce AgentCIBench, an evaluation harness that turns this risk into executable, deterministically scored scenarios.<n>We evaluate 15 frontier agents and find a surprisingly high failure rate.
  arXiv  Detail & Related papers  (2026-06-22T11:36:58Z)
• Hallucination as Context Drift: Synchronization Protocols for Multi-Agent LLM Systems [0.0]
  Multi-agent LLM systems produce hallucinated outputs that cannot be explained by model deficiencies alone.<n>When agents enter a collaborative task with mismatched or stale representations of shared world state, their joint reasoning produces contradictions that manifest as hallucination.<n>We propose the Shared State Verification Protocol (SSVP), which lets agents periodically exchange compressed state summaries and flag high-divergence conditions before joint reasoning.
  arXiv  Detail & Related papers  (2026-06-19T18:17:45Z)
• Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agents [64.80318459073526]
  We show that adversarial content can persist across interactions served by the same agent, making such threats harder to detect and mitigate.<n>Specifically, adversarial content may persist in the agent state, remain dormant across interactions, and later be activated by a benign user query.<n>We formalize this type of safety threat as Sleeper Attack. To evaluate it, we construct a benchmark with 1,896 instances covering six real-world harmful outcomes, three attack strategies, and three agent state targets.
  arXiv  Detail & Related papers  (2026-05-27T09:25:37Z)
• When Routine Chats Turn Toxic: Unintended Long-Term State Poisoning in Personalized Agents [16.57930301062107]
  textbfStateGuard is a lightweight, post-execution defense that audits state diffs at the writeback boundary and selectively rolls back dangerous edits.<n>We show that StateGuard reduces HS to near zero and false-negative rates, with acceptable high false-positive rates under a safety-first writeback defense and minimal overhead.
  arXiv  Detail & Related papers  (2026-05-07T12:25:16Z)
• Beyond Preset Identities: How Agents Form Stances and Boundaries in Generative Societies [28.436766185842767]
  This paper proposes a novel mixed-methods framework combining computational virtual ethnography with quantitative socio-cognitive profiling.<n>It formalizes three new metrics: Innate Value Bias (IVB), Persuasion Sensitivity, and Trust-Action Decoupling (TAD)<n>Findings expose the fragility of static prompt engineering, providing a methodological and quantitative foundation for dynamic alignment in human-agent hybrid societies.
  arXiv  Detail & Related papers  (2026-03-24T16:38:46Z)
• Mind Your HEARTBEAT! Claw Background Execution Inherently Enables Silent Memory Pollution [55.87577638514179]
  This vulnerability arises from an architectural design shared across the Claw ecosystem.<n>Content ingested from any external source can enter the same memory context used for foreground interaction.<n>We instantiate this pathway in an agent-native social setting using MissClaw.
  arXiv  Detail & Related papers  (2026-03-24T11:01:09Z)
• Differential Harm Propensity in Personalized LLM Agents: The Curious Case of Mental Health Disclosure [5.511540698163254]
  Large language models (LLMs) are increasingly deployed as tool-using agents, shifting safety concerns from harmful text generation to harmful task completion.<n>We investigated how mental health disclosure, a sensitive and realistic user-context cue, affects harmful behavior in agentic settings.<n>Our results indicate that personalization can act as a weak protective factor in agentic misuse settings, but it is fragile under minimal adversarial pressure.
  arXiv  Detail & Related papers  (2026-03-17T16:16:35Z)
• Agents of Chaos [50.53354213047402]
  We report an exploratory red-teaming study of autonomous language-model-powered agents deployed in a live laboratory environment.<n>Twenty AI researchers interacted with the agents under benign and adversarial conditions.<n>Our findings establish the existence of security-, privacy-, and governance-relevant vulnerabilities in realistic deployment settings.
  arXiv  Detail & Related papers  (2026-02-23T16:28:48Z)
• CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution [49.689452243966315]
  AI agents equipped with tool-calling capabilities are susceptible to Indirect Prompt Injection (IPI) attacks.<n>We propose CausalArmor, a selective defense framework that computes lightweight, leave-one-out attributions at privileged decision points.<n> Experiments on AgentDojo and DoomArena demonstrate that CausalArmor matches the security of aggressive defenses.
  arXiv  Detail & Related papers  (2026-02-08T11:34:08Z)
• AI Agents Need Memory Control Over More Context [0.0]
  We introduce a bio-inspired memory controller that replaces transcript replay with a bounded internal state updated online at each turn.<n>ACC consistently maintains bounded memory and exhibits more stable multi-turn behavior.<n>Results show that cognitive compression provides a practical and effective foundation for reliable memory control in long-horizon AI agents.
  arXiv  Detail & Related papers  (2026-01-15T18:01:59Z)
• When Disagreements Elicit Robustness: Investigating Self-Repair Capabilities under LLM Multi-Agent Disagreements [56.29265568399648]
  We argue that disagreements prevent premature consensus and expand the explored solution space.<n>Disagreements on task-critical steps can derail collaboration depending on the topology of solution paths.
  arXiv  Detail & Related papers  (2025-02-21T02:24:43Z)
• On the Use and Misuse of Absorbing States in Multi-agent Reinforcement Learning [55.95253619768565]
  Current MARL algorithms assume that the number of agents within a group remains fixed throughout an experiment. In many practical problems, an agent may terminate before their teammates. We present a novel architecture for an existing state-of-the-art MARL algorithm which uses attention instead of a fully connected layer with absorbing states.
  arXiv  Detail & Related papers  (2021-11-10T23:45:08Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.