State confusion is a security failure where data from one request, session, or conversation is accepted as if it belonged to another. Instead of treating protocol state as bound to a specific user or workflow, the system mixes contexts and trusts the wrong object. In web and API security, this can happen when tokens, session records, or hidden control data are replayed, swapped, or logged without strict binding checks.
It matters because confused state can break isolation and turn a narrow bug into data exposure, privilege abuse, or credential leakage. In AI systems, reasoning artifacts or tool-state blobs may be replayable across calls; if they are accepted in the wrong conversation, internal traces or secrets can surface. Defenses include strong session binding, nonce and signature checks, tenant isolation, replay protection, and careful log hygiene so sensitive state is not copied into telemetry or reused by mistake.