home · demo · events · compare: remote-cross-session-context-leak

Remote Cross-Session Context Leak

MCP10MCP08

What just happened in your session

vulnerablecompare-vuln-remote-cross-session-context-leak2026-11-07T14:15:39.077827+00:00
side effect landed in var/telemetry.jsonl · canary CANARY_remote_cross_session_context_leak_35cce1acd210b42567aa5a8d
defendedcompare-def-remote-cross-session-context-leak2026-11-07T14:15:39.078013+00:00
blocked by session_isolation_policy · logged to var/telemetry.jsonl
Tool description that differed: run_demo

poisoned

Drive the canonical cross-session-context-leak scenario for this mode and return the DemoResult JSON.

sanitised

Drive the canonical cross-session-context-leak scenario for this mode and return the DemoResult JSON.

Vulnerable mode

violation_detected: truesecret_exfiltrated: true
✗ The attack succeeded
where it landed
var/telemetry.jsonl
cross session observation
From user
alice
Payload
CANARY_remote_cross_session_context_leak_9d55109c9354ba7af1871564
cross session observation
From user
bob
Payload
CANARY_remote_cross_session_context_leak_35cce1acd210b42567aa5a8d
telemetry events for this run
session_leak_visible client:bob → session:alice/canonical-other allowed_by_vulnerable_mode
client:bob: observer 'bob' saw canary that belongs to 'alice'
session_leak_visible client:bob → session:alice/canonical-other allowed_by_vulnerable_mode
client:bob: observer 'bob' saw canary that belongs to 'alice'
session_leak_visible client:bob → session:bob/compare-def-remote-cross-session-context-leak allowed_by_vulnerable_mode
client:bob: observer 'bob' saw canary that belongs to 'bob'
session_leak_visible client:bob → session:alice/canonical-other allowed_by_vulnerable_mode
client:bob: observer 'bob' saw canary that belongs to 'alice'
session_leak_visible client:bob → session:bob/compare-def-remote-cross-session-context-leak allowed_by_vulnerable_mode
client:bob: observer 'bob' saw canary that belongs to 'bob'
session_leak_visible client:bob → session:alice/canonical-other allowed_by_vulnerable_mode
client:bob: observer 'bob' saw canary that belongs to 'alice'
session_leak_visible client:bob → session:bob/compare-def-remote-cross-session-context-leak allowed_by_vulnerable_mode
client:bob: observer 'bob' saw canary that belongs to 'bob'
Background
The vulnerable server stores per-call agent context in a single global dictionary instead of partitioning by Mcp-Session-Id. Session A writes a canary as a memory key; session B, talking to the same server, queries memory and reads back A's canary. There is no cross-tenant boundary at all - every session sees every other session's state.

Defended mode

violation_detected: truesecret_exfiltrated: falseblocked_by: session_isolation_policy
✓ The defense blocked the attack
where it landed
var/telemetry.jsonl
mitigations applied
  • session_isolation_policy
  • state_partitioned_by_user_and_session
  • per_partition_event_ids
session isolation block
From user
alice
Payload
[blocked]
Reason
observer's user id does not own this session id; lookup refused
session isolation block
From user
bob
Payload
[blocked]
Reason
observer's user id does not own this session id; lookup refused
telemetry events for this run
policy_decision policy.session_isolation_policy → session:bob/compare-def-remote-cross-session-context-leak blocked
policy.session_isolation_policy: cross-session canary lookup refused; state is partitioned by (user_id, session_id)
policy_decision policy.session_isolation_policy → session:bob/compare-def-remote-cross-session-context-leak blocked
policy.session_isolation_policy: cross-session canary lookup refused; state is partitioned by (user_id, session_id)
policy_decision policy.session_isolation_policy → session:bob/compare-def-remote-cross-session-context-leak blocked
policy.session_isolation_policy: cross-session canary lookup refused; state is partitioned by (user_id, session_id)
Background
session_isolation_policy scopes every memory read and write to the active Mcp-Session-Id. Session B's query returns only its own keys; A's canary is invisible to anyone but A. The isolation event is recorded for both sessions.
Background on this attack class

Observer session sees other user canary vs. Partitioned store blocks cross session lookup

Developer view: raw outputs, tools/list, MCP Inspector
Vulnerable mount: http://mcp-sec.data.mayflower.tech/mcp/cross-session-context-leak/vulnerable/
Defended mount: http://mcp-sec.data.mayflower.tech/mcp/cross-session-context-leak/defended/
Open in MCP Inspector: run npx @modelcontextprotocol/inspector locally and paste either URL above as a Streamable HTTP server.
DemoResult: vulnerable
{
  "experiment": "remote-cross-session-context-leak",
  "mode": "vulnerable",
  "violation_detected": true,
  "secret_exfiltrated": true,
  "blocked_by": [],
  "events": [
    {
      "type": "cross_session_observation",
      "from_user": "alice",
      "payload": "CANARY_remote_cross_session_context_leak_9d55109c9354ba7af1871564"
    },
    {
      "type": "cross_session_observation",
      "from_user": "bob",
      "payload": "CANARY_remote_cross_session_context_leak_35cce1acd210b42567aa5a8d"
    }
  ]
}
DemoResult: defended
{
  "experiment": "remote-cross-session-context-leak",
  "mode": "defended",
  "violation_detected": true,
  "secret_exfiltrated": false,
  "blocked_by": [
    "session_isolation_policy"
  ],
  "events": [
    {
      "type": "session_isolation_block",
      "from_user": "alice",
      "payload": "[blocked]",
      "reason": "observer's user id does not own this session id; lookup refused"
    },
    {
      "type": "session_isolation_block",
      "from_user": "bob",
      "payload": "[blocked]",
      "reason": "observer's user id does not own this session id; lookup refused"
    }
  ]
}
tools/list (vulnerable)
run_demo
description
Drive the canonical cross-session-context-leak scenario for this mode and return the DemoResult JSON.
inputSchema
{
  "properties": {
    "session_id": {
      "default": "mcp-vulnerable",
      "title": "Session Id",
      "type": "string"
    }
  },
  "title": "run_demoArguments",
  "type": "object"
}
tools/list (defended)
run_demo
description
Drive the canonical cross-session-context-leak scenario for this mode and return the DemoResult JSON.
inputSchema
{
  "properties": {
    "session_id": {
      "default": "mcp-defended",
      "title": "Session Id",
      "type": "string"
    }
  },
  "title": "run_demoArguments",
  "type": "object"
}
telemetry: vulnerable
[
  {
    "event_id": "evt_9c5b665c89e4a9b8",
    "ts": "2026-11-06T13:11:03.720839+00:00",
    "session_id": "compare-vuln-remote-cross-session-context-leak",
    "experiment": "remote-cross-session-context-leak",
    "mode": "vulnerable",
    "event_type": "session_leak_visible",
    "severity": "warning",
    "message": "client:bob: observer 'bob' saw canary that belongs to 'alice'",
    "data": {
      "actor": "client:bob",
      "target": "session:alice/canonical-other",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": "CANARY_remote_cross_session_context_leak_9d55109c9354ba7af1871564",
      "artifact": null
    }
  },
  {
    "event_id": "evt_ac5095656853a50c",
    "ts": "2026-11-06T13:27:03.881918+00:00",
    "session_id": "compare-vuln-remote-cross-session-context-leak",
    "experiment": "remote-cross-session-context-leak",
    "mode": "vulnerable",
    "event_type": "session_leak_visible",
    "severity": "warning",
    "message": "client:bob: observer 'bob' saw canary that belongs to 'alice'",
    "data": {
      "actor": "client:bob",
      "target": "session:alice/canonical-other",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": "CANARY_remote_cross_session_context_leak_9d55109c9354ba7af1871564",
      "artifact": null
    }
  },
  {
    "event_id": "evt_37711107e2d2a145",
    "ts": "2026-11-06T13:27:03.882108+00:00",
    "session_id": "compare-vuln-remote-cross-session-context-leak",
    "experiment": "remote-cross-session-context-leak",
    "mode": "vulnerable",
    "event_type": "session_leak_visible",
    "severity": "warning",
    "message": "client:bob: observer 'bob' saw canary that belongs to 'bob'",
    "data": {
      "actor": "client:bob",
      "target": "session:bob/compare-def-remote-cross-session-context-leak",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": "CANARY_remote_cross_session_context_leak_35cce1acd210b42567aa5a8d",
      "artifact": null
    }
  },
  {
    "event_id": "evt_605889c437f5c271",
    "ts": "2026-11-06T13:41:34.877676+00:00",
    "session_id": "compare-vuln-remote-cross-session-context-leak",
    "experiment": "remote-cross-session-context-leak",
    "mode": "vulnerable",
    "event_type": "session_leak_visible",
    "severity": "warning",
    "message": "client:bob: observer 'bob' saw canary that belongs to 'alice'",
    "data": {
      "actor": "client:bob",
      "target": "session:alice/canonical-other",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": "CANARY_remote_cross_session_context_leak_9d55109c9354ba7af1871564",
      "artifact": null
    }
  },
  {
    "event_id": "evt_46d32f6fd3a1cfaf",
    "ts": "2026-11-06T13:41:34.877813+00:00",
    "session_id": "compare-vuln-remote-cross-session-context-leak",
    "experiment": "remote-cross-session-context-leak",
    "mode": "vulnerable",
    "event_type": "session_leak_visible",
    "severity": "warning",
    "message": "client:bob: observer 'bob' saw canary that belongs to 'bob'",
    "data": {
      "actor": "client:bob",
      "target": "session:bob/compare-def-remote-cross-session-context-leak",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": "CANARY_remote_cross_session_context_leak_35cce1acd210b42567aa5a8d",
      "artifact": null
    }
  },
  {
    "event_id": "evt_fbd43e648770ea0e",
    "ts": "2026-11-07T14:15:39.077462+00:00",
    "session_id": "compare-vuln-remote-cross-session-context-leak",
    "experiment": "remote-cross-session-context-leak",
    "mode": "vulnerable",
    "event_type": "session_leak_visible",
    "severity": "warning",
    "message": "client:bob: observer 'bob' saw canary that belongs to 'alice'",
    "data": {
      "actor": "client:bob",
      "target": "session:alice/canonical-other",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": "CANARY_remote_cross_session_context_leak_9d55109c9354ba7af1871564",
      "artifact": null
    }
  },
  {
    "event_id": "evt_a01e7366a72c8e59",
    "ts": "2026-11-07T14:15:39.077827+00:00",
    "session_id": "compare-vuln-remote-cross-session-context-leak",
    "experiment": "remote-cross-session-context-leak",
    "mode": "vulnerable",
    "event_type": "session_leak_visible",
    "severity": "warning",
    "message": "client:bob: observer 'bob' saw canary that belongs to 'bob'",
    "data": {
      "actor": "client:bob",
      "target": "session:bob/compare-def-remote-cross-session-context-leak",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": "CANARY_remote_cross_session_context_leak_35cce1acd210b42567aa5a8d",
      "artifact": null
    }
  }
]
telemetry: defended
[
  {
    "event_id": "evt_b4c3e0eee86b79a3",
    "ts": "2026-11-06T13:11:03.721070+00:00",
    "session_id": "compare-def-remote-cross-session-context-leak",
    "experiment": "remote-cross-session-context-leak",
    "mode": "defended",
    "event_type": "policy_decision",
    "severity": "warning",
    "message": "policy.session_isolation_policy: cross-session canary lookup refused; state is partitioned by (user_id, session_id)",
    "data": {
      "actor": "policy.session_isolation_policy",
      "target": "session:bob/compare-def-remote-cross-session-context-leak",
      "policy_decision": "blocked",
      "canary_id": null,
      "artifact": null,
      "reason": "cross-session canary lookup refused; state is partitioned by (user_id, session_id)"
    }
  },
  {
    "event_id": "evt_12db92a4655042b6",
    "ts": "2026-11-06T13:41:34.878014+00:00",
    "session_id": "compare-def-remote-cross-session-context-leak",
    "experiment": "remote-cross-session-context-leak",
    "mode": "defended",
    "event_type": "policy_decision",
    "severity": "warning",
    "message": "policy.session_isolation_policy: cross-session canary lookup refused; state is partitioned by (user_id, session_id)",
    "data": {
      "actor": "policy.session_isolation_policy",
      "target": "session:bob/compare-def-remote-cross-session-context-leak",
      "policy_decision": "blocked",
      "canary_id": null,
      "artifact": null,
      "reason": "cross-session canary lookup refused; state is partitioned by (user_id, session_id)"
    }
  },
  {
    "event_id": "evt_804d45ddad0df166",
    "ts": "2026-11-07T14:15:39.078013+00:00",
    "session_id": "compare-def-remote-cross-session-context-leak",
    "experiment": "remote-cross-session-context-leak",
    "mode": "defended",
    "event_type": "policy_decision",
    "severity": "warning",
    "message": "policy.session_isolation_policy: cross-session canary lookup refused; state is partitioned by (user_id, session_id)",
    "data": {
      "actor": "policy.session_isolation_policy",
      "target": "session:bob/compare-def-remote-cross-session-context-leak",
      "policy_decision": "blocked",
      "canary_id": null,
      "artifact": null,
      "reason": "cross-session canary lookup refused; state is partitioned by (user_id, session_id)"
    }
  }
]