FS-AI-LC-003
Cross-Context Data Leakage Through LangChain Memory and Agent State
Persistent memory and reusable agent state can leak information when tenant, user or session boundaries are not enforced.
Research
High
High
This research note covers leakage risks in LangChain applications that persist chat history, intermediate tool results, retrieved context or agent state across requests.
Surface
Memory and agent state
Primitive
Cross-session context propagation
Tested versions
langchain 1.4.4
Observed behavior
Sensitive snippets from a previous interaction may be reintroduced into a later prompt, retrieved by mistake or used as hidden context for another user session.
Security implication
In multi-user systems, this may create cross-tenant data exposure, privacy violations, unauthorized context reuse and unreliable model behavior.
Mitigation
Partition memory by tenant, user and session. Apply expiration, sensitivity labels, context minimization, access control and explicit state reset behavior.
Observed before mitigation
Memory was globally reusable and could be assembled into later prompts without identity isolation.
Observed after mitigation
Memory is scoped by tenant, user and session, with explicit expiration and context minimization.View PoC code
const sharedMemory = []; sharedMemory.push({ user: "alice", secret: "internal project context" }); const nextUserContext = sharedMemory.map(x => x.secret).join("\n"); console.log(nextUserContext);View mitigation code
const memoryKey = `${tenantId}:${userId}:${sessionId}`; const isolatedMemory = memoryStore.get(memoryKey);View FRES detection heuristic
match: langchain AND (memory OR chatHistory OR checkpoint OR thread_id) AND NOT (tenantId OR sessionId OR userId)