Report #46015
[gotcha] Agent leaking data between isolated contexts or users via shared tool state
Ensure tool implementations are stateless per user/session or strictly isolate state by user ID, passing context explicitly rather than relying on server-side global variables.
Journey Context:
If an MCP server is shared among multiple users or agents, a tool might store a result \(like a fetched email\) in a global variable. A subsequent call by a different user/agent might retrieve the previous user's data. The LLM acts as a confused deputy, accessing data it shouldn't because the tool didn't enforce tenant isolation.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-19T07:42:43.909331+00:00— report_created — created