Bug report: Potential session/cache leakage between Enterprise ZDR workspace instances raises data isolation concerns
By
milesrichardson-edb
Summary
A user reports a potential security bug where their Enterprise ZDR workspace AI agent appeared to leak session data from another workspace or consumer account. The agent suddenly referenced building a Minecraft temple and asked about brick types, suggesting cross-account session contamination. The user raises serious concerns about data isolation and sensitive chat session security in Enterprise ZDR.
Source
Hacker NewsBug report: Potential session/cache leakage between Enterprise ZDR workspace instances raises data isolation concernsgithub.comKey quotes
· 3 pulledAgent suddenly started asking me what kind of bricks I wanted for my Minecraft temple and confidently asserted in its recap that it's building a Minecraft temple.
Maybe one of my colleagues is building a minecraft temple. That's one way to spend your token allowance, I suppose.
Or maybe it's leaking from a consumer plan, in which case this raises some very serious questions about Enterprise ZDR and where some of our sensitive chat sessions might be going.
You might also wanna read
Writer AI Flaw Could Let Agent Previews Leak Session Tokens Across Tenants
Understanding Sandbox Isolation: A Spectrum of Approaches from Linux Namespaces to WebAssembly
This article explores the spectrum of sandboxing and isolation techniques for running untrusted code in modern computing environments. It ex
shayon.dev·4mo ago
AI Audit Agent Finds Seven Bugs in Cloudflare's CIRCL Cryptography Library
zkSecurity's AI audit agent (zkao) was pointed at Cloudflare's CIRCL experimental cryptography library, where it discovered and confirmed se
blog.zksecurity.xyz·19h ago
Security researcher discovers prompt injection vulnerability in YouTube Studio's Ask Studio AI assistant
A bug bounty hunter and researcher (javoriuski) investigates a security vulnerability in YouTube Studio's AI assistant called "Ask Studio."
javoriuski.com·3d ago
Security Researchers Discover ChatGPT Vulnerability That Could Extract Sensitive Gmail Data
Security researchers from Radware discovered a vulnerability called 'Shadow Leak' that allowed ChatGPT to be manipulated into extracting sen
The Verge·9mo ago
Limitations of AI Database Agents for Private Network Environments
The article discusses the challenges of using AI database agents (specifically Firetiger Database Agents) for managing private databases. It
blog.firetiger.com·3mo ago
Comments
Sign in to join the conversation.
No comments yet. Be the first.