GPT-5 retry errors raise cross-session contamination risk

At a glance

What this is: Knostic reports that a GPT-5 Retry flow after a message length error could reconstruct context incorrectly and produce unrelated responses across sessions.

Why it matters: For AI security and identity practitioners, the issue shows that error paths, session state handling, and context reconstruction need governance controls as strict as normal generation paths.

Context

A retry path in an AI chat system is not just a user convenience. It can become a control boundary if the backend reconstructs context from stale state, cached data, or an incomplete conversation record after a failed turn.

This case sits in AI security and governance, but it also touches identity and session integrity because the system is deciding which conversation state belongs to which request. When that mapping is loose, cross-session contamination becomes a governance problem, not only a bug.

The pattern described here is atypical in the sense that it appears after an error condition rather than a normal prompt flow, which is exactly why it matters for enterprise AI deployments.

Key questions

Q: What breaks when a retry flow rebuilds AI context after a failed turn?

A: The main failure is loss of session provenance. If the original message was never committed, a retry that reconstructs context from partial identifiers or cached data can answer from the wrong conversation branch. That creates contamination risk even when no explicit access control is bypassed, because the system can no longer prove which context belongs to the request.

Q: Why do prompts create governance risk in generative AI systems?

A: Prompts can carry instructions, context, and implicit authority into the model. If they are not controlled, they can expose sensitive data, override system constraints, or trigger unintended actions. That is why prompt security belongs in AI governance, access control, and data protection planning.

Q: What are the signs that an AI session is failing?

A: Common signs of session failure include incorrect or inconsistent answers across turns, users repeating the same request, visible confusion, and frustration in the conversation. Another warning sign is when the model never helps the user reach the intended outcome. Those signals show the system may be locally correct at the span level but unsuccessful end to end.

Q: How should teams govern AI retry behaviour in regulated environments?

A: Teams should require deterministic retry logic, explicit session binding, and auditability for any fallback context source. In regulated environments, the standard is not just that the model works, but that the system can prove which conversation state was used, how it was recovered, and whether any cross-session reuse occurred.

Technical breakdown

How retry flows can break conversation state

A Retry action in a chat system is supposed to resubmit the same logical turn, but that assumption depends on the original message being fully stored and bound to the right session. If the backend never commits the failed turn, the next request may arrive without a complete messages array. The server then has to rebuild context from partial identifiers such as parent_message_id and any cached conversation state it can find. That reconstruction path is fragile because it is no longer operating on a single authoritative transcript, but on a best-effort merge of session fragments.

Practical implication: Treat retry handling as a separate security path and test whether it preserves session integrity when the original turn fails.

Why cache reuse and parent message binding matter

The observed behavior is consistent with a context lookup problem rather than a model inference problem. If cache keys collide across accounts or sessions, a system can pull in stale conversation material that looks valid enough to satisfy the request. A similar failure can happen when parent_message_id is associated with the wrong active session, especially when the originating turn was invalid. In that case, the system may reconstruct a plausible conversation from the wrong branch, which is exactly how unrelated content can leak into a reply without any obvious access violation.

Practical implication: Enforce strict session-to-context binding and verify that invalid turns cannot inherit state from unrelated conversations.

Why error handling needs LLM-specific controls

LLM applications do not fail safely just because the model returns a fluent answer. When an error path reconstructs state incorrectly, the output may still look normal while carrying the wrong conversation context. That creates a governance blind spot because conventional checks often focus on successful prompts, not on malformed requests, retries, or recovery flows. In enterprise settings, those paths should be treated as first-class attack surface because they can expose data relationships, user trust boundaries, and policy enforcement gaps at the same time.

Practical implication: Add testing, logging, and policy enforcement to malformed-request and retry paths, not only to standard prompt execution.

Threat narrative

Attacker objective: The objective would be to cause the system to surface unrelated conversation context, potentially exposing material from another session or user.

1. Entry occurs when a user submits an over-length prompt that triggers a message_length_exceeds_limit error instead of a normal turn.
2. Credentialed context is not the issue here; the risk begins when the client retries without sending the full messages array and the server rebuilds state from partial identifiers and cached data.
3. The failure can escalate into cross-session contamination if the reconstructed context is misbound to a different conversation or stale cache entry.
4. Impact is an unrelated response that may expose another conversation's material or undermine trust in the AI system's session isolation.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Cross-session contamination is a session-governance failure, not just a model glitch. The problem described here sits at the boundary between application state, session integrity, and AI output reliability. If retry flows can reconstruct the wrong context, then the system has lost control over conversation provenance. Practitioners should treat state binding as part of AI governance, not a UI detail.

Error paths deserve the same policy rigor as successful prompts. Many AI controls are designed around normal request flow, but the article shows that malformed input and recovery logic can be where containment fails. That means prompt filters alone are insufficient if backend reconstruction can bypass the intended conversation boundary. The practical lesson is to govern failure handling as a security control surface.

Context reconstruction trust gap: this is the specific failure mode the article exposes. The system appears to trust cached or inferred context after a failed turn, even though the original message never entered a committed state. That is a control gap in provenance, and it should push teams to validate how every retry, resume, and recovery action re-establishes session ownership.

AI TRiSM-style governance needs a stronger view of recovery flows. Trust, risk, and security models usually emphasize model outputs, policy enforcement, and user access, but this case shows that conversation repair logic can be equally consequential. For regulated or enterprise deployments, the question is not only what the model says, but whether the system can prove which session state produced it.

For identity teams, the issue is session identity continuity. The article highlights that AI systems increasingly need identity-like guarantees about which request belongs to which conversation state. Where session mapping is weak, the boundary between one user's context and another's becomes porous. Practitioners should therefore connect AI governance to identity, session, and access-control disciplines.

What this signals

Context reconstruction trust gap: the important design issue is not whether an LLM can generate a fluent reply after an error, but whether the application can prove that the reply belongs to the right session. When retry logic can fall back to cached or inferred state, the control boundary moves from generation to recovery, and that is where enterprise AI governance needs to be strongest.

AI security teams should assume that malformed requests and recovery flows are part of the attack surface. If those paths are not instrumented, tested, and policy-checked, they can create a silent failure mode where the system looks functional while crossing conversation boundaries.

For practitioners

• Harden retry-path session binding Validate that Retry cannot reconstruct conversation state from parent_message_id alone. Require a committed transcript or fail closed when the original turn was rejected before state storage.
• Separate cache keys by session and account Review whether cached conversation fragments can cross account boundaries under collision or reuse conditions. Use session-scoped keys and test for stale-state retrieval during error recovery.
• Test malformed-request recovery flows Build test cases for length-limit errors, retry actions, and partial payloads. Include negative tests that prove the system does not answer from unrelated cached context after a failed turn.
• Log state reconstruction decisions Record when the backend falls back to cached data, a parent_message_id lookup, or any non-default context source. Tie those events to audit trails so unexpected cross-session reuse can be investigated.

Key takeaways

• The article describes a repeatable retry-path failure in which GPT-5 could answer from mismatched or stale context after a length-limit error.
• The central risk is not confirmed data exfiltration, but the loss of session integrity that can make unrelated conversation material appear in a reply.
• Teams need controls over fallback state, session binding, and audit trails for error recovery paths, because those paths can be more dangerous than the normal prompt flow.

Key terms

• Cross-session contamination: Cross-session contamination is the unplanned mixing of conversation state from one user interaction into another. In AI systems, it usually appears when caches, retries, or context reconstruction logic pull from the wrong session boundary and produce responses that are technically valid but operationally misattributed.
• Context Reconstruction: Context reconstruction is the process of combining identity data, logs, vault events, and application telemetry to understand what a non-human identity is, what it can reach, and why it exists. It turns raw inventory into governance-relevant evidence that can support ownership, attestation, and risk prioritisation.
• Session provenance: The evidence chain that links a session back to the human initiator, the non-human identity used, and the systems touched during execution. In agentic environments, provenance is what turns activity into attributable identity behaviour instead of an opaque sequence of events.
• Retry Path: A retry path is the alternative processing route a user triggers after a failed AI action. In secure systems, the retry path should reproduce the original request deterministically. If it reconstructs context from partial metadata or cached data, it can bypass the assumptions that protect conversation integrity.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It helps security and IAM practitioners connect identity controls to the AI systems now entering enterprise workflows.