Isolate sessions and expose only what is strictly needed.
The threat
the attacker draws data from another user or from the system's memory (data leakage, system prompt extraction, exfiltration) without necessarily cracking anything.
Blind spotWhy classic frameworks miss it
the boundary is no longer network or storage but session and reasoning: the system's memory (RAG, history, context) can leak between users or be extracted by a question.
MitigationProposed approach
isolation of calls and of the knowledge base (RAG), least access, never cross-session access; per-requester source segregation; output redaction.
The proposed control
no cross-session access and no system prompt extraction.
Expected evidence
prove that one session cannot read another's memory or extract the system prompt.
SourcesReferences and public research
MITRE ATLAS 2026.07AML.T0085 Data from AI Services · AML.T0024 Exfiltration via AI Inference API
OWASP GenAIOWASP GenAI LLM02:2025 Sensitive Information Disclosure · OWASP GenAI LLM07:2025 System Prompt Leakage
Public researchPublic research sources: MITRE ATLAS 2026.07 (verified technique mapping), OWASP GenAI, and the public risk-voicebot (aivansoul/risk-voicebot) template defining the 20 checkpoints. No client registry data: generic card, no rating, no verdict.