Cross-Session Data Leak in Strands Agents A2A Server

Executive Summary

A high-severity cross-session data leak affects the Strands Agents Agent2Agent server in multi-tenant deployments. Organizations running this component should prioritize conversation-state isolation and authenticated-user access controls.

What Happened

Affected Products

• Strands Agents Agent2Agent server

Vulnerability / Attack Technique

Cross-session conversation-state isolation failure

Technical Mechanism

In multi-tenant deployments, inadequate isolation of conversation state could allow an authenticated remote user to access another caller's history or influence model behavior. The summary does not provide further implementation details.

AI Security Category

LLM02:2025 Sensitive Information Disclosure

Relevant Frameworks

RealGround Analysis

Cross-session state leakage can expose tenant or caller data and may affect the behavior of an AI agent operating with another user's context. Teams running AI agents or LLM applications should test tenant separation, session binding, and authorization at the agent-server boundary.

Recommended Controls

• Bind every conversation-state record to an authenticated user and tenant identifier.
• Enforce authorization checks before reading, updating, or reusing conversation history.
• Use isolated session stores or logically enforced tenant partitioning for multi-tenant deployments.
• Add automated cross-tenant and cross-session access tests to security regression suites.
• Conduct adversarial red-team testing for unauthorized history access and cross-session behavior influence.

Related RealGround Service

AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.

Sources

AI Sec Watch: https://aisecwatch.com/archive

Summary and analysis written by RealGround from the source above; last updated 2026-10-25.