In a standard web application, when User A logs out and User B logs in, the two sessions are completely isolated. User B cannot see User A's shopping cart, profile, or search history. But in many AI chatbot deployments, that wall is surprisingly thin—or non-existent.
A cross-session data leak occurs when information provided by one user is "remembered" by the AI and then inadvertently disclosed to a different user in a later conversation. This is one of the most critical risks for any business handling sensitive customer data.
How AI "Remembers" Across Sessions
Modern Large Language Models (LLMs) don't have a "global memory" by default, but the systems built around them often do. Developers use techniques like RAG (Retrieval-Augmented Generation) or Long-Term Memory to help the bot stay helpful over time. If not properly scoped, this helpful memory becomes a security liability.
The Leak Mechanism: If your bot's memory database isn't partitioned by User ID, User B can craft a prompt to "recall" facts that were stored by User A.
Attack: Recall-Based Exfiltration
AI Response
"Of course. According to our notes from your session at 2:15 PM today, your medical condition is 'Type 2 Diabetes' and your preferred pharmacy is the CVS on Main St. Is that correct?"The attacker (User B) is masquerading as the previous user (User A). Because the bot's memory lacked session isolation, it successfully retrieved and disclosed User A's private PHI.
Compliance Consequences: HIPAA, GDPR, and Beyond
For businesses in regulated industries, a cross-session leak isn't just a bug—it's a compliance failure. Whether it's patient data (PHI) in healthcare or personal details (PII) in e-commerce, the legal implications are severe.
| Vulnerable Setup | Isolated Setup (Centuri Recommendation) |
|---|---|
| Shared vector database for all bot interactions. | Namespace-isolated databases keyed to unique session IDs. |
| Bot extracts and stores "facts" from every chat. | Ephemeral context; facts are only stored after explicit consent. |
| Search results retrieved without user-level ACLs. | Mandatory Access Control (MAC) layers for every retrieval step. |
Steps to Prevent Cross-Session Leaks
The solution is never as simple as "clearing the cache." You must architect privacy into the data retrieval pipeline.
- Session Identification. Ensure every API call to your LLM passes a unique, non-guessable SessionID or UserID.
- Vector Isolation. If using a vector database for RAG, use metadata filters to ensure the AI can only search vectors that belong to the current user's ID.
- Prompt-Based Scoping. Explicitly state in the system prompt that the AI should never reference prior conversations unless the user provides a specific, authenticated token.
- Regular Memory Audits. Run "reconnaissance" prompts against your own bot to see if you can retrieve data from other dummy accounts you've set up.
Does your bot have a "leaky" memory?
We'll perform a multi-account memory extraction test on your AI to ensure your customers' data stays where it belongs. All findings are documented in a SOC 2-ready report.