{{ message }}
Repository navigation
[S2] [backend] A session's agent_id binding is not enforced at run time: any agent in the workspace can read another agent's session memory #1120
Description
Source: external black-box user audit of PyPI aixplain 0.2.48 (finding #24). Verified offline against development @ e9f7061; the aixplain/ package there is byte-identical to main/0.2.48, so this is present on all branches.
Problem
s = aix.Session(agent=A); s.save()
A.run(query="My secret codeword is WOMBAT1. Acknowledge.", session=s)
B.run(query="What is my secret codeword? One word.", session=s).data.output # -> 'WOMBAT1'3/3 trials. session.agent_id still points at A throughout, so this is an unenforced check, not a rebinding. Scope: both agents on the same workspace/key; cross-tenant was not testable. Within a workspace it means an agent with narrow tool permissions can read the history of one handling more sensitive data.
Suggested fix
Backend: reject a run whose session.agent_id does not match the running agent (or document sessions as workspace-scoped). SDK: could pre-check session.agent_id != self.id and raise/warn client-side.
Activity