Cross-user contamination is a failure mode in which stored context from one user’s session is reused in another user’s session. In AI systems, that context may include prompts, summaries, retrieved facts, preferences, or tool outputs. If isolation is weak, the system can treat another user’s data as if it were part of the current conversation.
This matters because it can leak private information, distort answers, and cause one user’s mistake to become another user’s guidance. In real attacks, contamination can happen through shared caches, mis-scoped memory, poor tenant separation, or broken access controls. Defenses include strict session binding, per-user and per-tenant segmentation, provenance checks, expiration policies, and auditing of what memory can be read or written. Good isolation keeps reusable context from becoming an unintended shared channel.