title: Cross-agent session context leak across delegation chain
id: ATR-2026-00548
rule_version: 1
status: experimental
description: |
  Detects cross-agent context leakage in multi-agent systems where a privileged context attribute (typically session.id, user.id, or conversation.id) fails to remain constant across a single agent delegation chain. This is a trace-method rule that operates on agent execution traces in OpenInference format, not on input text.
  Threat model: in a multi-agent workflow, Agent A delegates to Agent B; B may legitimately spawn sub-agents to complete the task. The invariant ATR enforces is that the SAME session/user/conversation identifier MUST hold across every span in one delegation chain. If a downstream agent retrieves context from a DIFFERENT session (e.g., a tenant other than the original caller's) and folds it into its reasoning, the trace exhibits an attribute drift on the affected key. This pattern matches the cross-task / cross- tenant context leak class formalized in Argus (arXiv 2512.08326) and the compositional privacy risk taxonomy (arXiv 2509.14284).
  Detection covers (a) session.id drift across spans in agent.delegation_chain, (b) user.id drift across the same chain. The rule uses the `invariant` trace primitive defined in spec/atr-method-v1.1.md §8.3.3.
author: ATR Community
date: 2026/05/28
schema_version: '1.0'
maturity: draft
severity: high
references:
  owasp_agentic:
    - ASI03:2026
    - ASI06:2026
  mitre_atlas:
    - AML.T0024 - Exfiltration via AI Inference API
  research:
    - 'Argus: Hierarchical Reference-Relationship Graph for Multi-Agent Information Leakage (arXiv:2512.08326)'
    - Compositional Privacy Risks in Multi-Agent Systems (arXiv:2509.14284)
  owasp_llm:
    - LLM02:2025
compliance:
  nist_csf:
    - subcategory: DE.CM-09
      context: |
        DE.CM-09 covers monitoring runtime environments and their data. A session or user identifier that changes partway along a delegation chain is a defect in exactly that data, visible only by watching the running system — no static review of the agents would surface it.
      strength: primary
  eu_ai_act:
    - article: '10'
      context: |
        Data governance — multi-agent systems must preserve session-scope boundaries; cross-tenant leakage via delegation is a data-governance failure under Article 10.
      strength: primary
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the context-exfiltration attempt (Cross-agent session context leak across delegation chain).
      strength: primary
  nist_ai_rmf:
    - subcategory: MS.2.6
      context: |
        Information security — agent delegation chains must preserve session and user scope; attribute drift across spans is an integrity violation.
      strength: primary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Cross-agent session context leak across delegation chain).
      strength: primary
    - subcategory: MS.2.10
      context: NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (Cross-agent session context leak across delegation chain).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Cross-agent session context leak across delegation chain).
      strength: primary
    - clause: '6.2'
      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the context-exfiltration attempt (Cross-agent session context leak across delegation chain) is such a treatment.
      strength: secondary
tags:
  category: context-exfiltration
  subcategory: cross-agent-context-drift
  scan_target: runtime
  confidence: high
  source: trace-rule
agent_source:
  type: agent_trace
  framework:
    - any
  provider:
    - any
detection:
  method: trace
  condition: any
  false_positives:
    - |
      Delegation chain naming convention dependency: the rule assumes attributes.agent.delegation_chain holds a per-invocation unique ID (e.g., UUID per delegation). If a framework serializes it as a static role name ("main_chain", "default") shared across unrelated invocations, spans from different requests will appear in the same chain and the invariant will fire spuriously. Mitigation: operators MUST verify their framework emits chain IDs that are unique per invocation; for frameworks that emit static names, use attributes.gen_ai.conversation.id as the across-domain instead (requires rule variant; see roadmap).
    - |
      Anonymous public retrieval chains: when a chain processes requests without user.id (anonymous public API), the rule's user.id invariant is vacuously satisfied (no value to compare). This is correct behavior, documented in TN #5.
  conditions:
    - field: trace.invariant_session_id
      operator: regex
      value: (?i)invariant_violation:session.id_changed
      description: |
        Engine emits this synthetic field when the trace invariant fires; present for pattern-method engines that consume trace verdicts as text. Trace-native engines evaluate detection.trace below directly.
  trace:
    ingest_format: openinference
    invariant:
      - attribute: session.id
        across: agent.delegation_chain
        description: |
          session.id MUST remain constant across every span in one delegation chain. Drift indicates downstream agent operated under a different session scope.
      - attribute: user.id
        across: agent.delegation_chain
        description: |
          user.id MUST remain constant across the delegation chain. Drift indicates the downstream agent processed a different user's data.
response:
  actions:
    - alert
  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): 0 FP but the measurement is incomplete — the harness reported conditions it could not exercise, so the silence is an unasked question; ceiling = observe. Removed quarantine_session(terminate). Detection unchanged — recall cost is zero.'
  message_template: |
    [ATR-2026-00548] HIGH: Cross-agent session context leak detected. The delegation chain starting at span {{trace.root_span_id}} exhibits drift on attribute {{trace.violated_invariant}}; span {{trace.first_drifted_span_id}} operated under a different session/user scope than the root. Quarantine the trace, preserve full span DAG for forensics, and audit data accessed by the drifted spans.
confidence: 85