Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Potential session/cache leakage between workspace instances or consumer accounts

github.com

Post reply on HN
Print view View original

71–80 of 151 posts

Re: Potential session/cache leakage between workspace instances or consumer accounts

#71

Post by margalabargala »

estebarb wrote: post #30
ec109685 wrote: post #8

Caching doesn’t work the way the bug reporter implies. Caches are shared (at least across the enterprise), but its key is always a function of the input before it. We achieved significant savings simply by moving everything that varies across individuals out of the system prompt so every session starts from a cache point. For example you never want your system prompt to start with the time that the session started. M…

Hash functions necesarily have collisions. Also, it is perfectly possible to introduce bugs in the hash function (hash inputs, hash function itself) that allows cross account contamination.

Hash functions necessarily have collisions, but it's perfectly possible to make the expected time between collisions greater than the human lifespan.

Re: Potential session/cache leakage between workspace instances or consumer accounts

#72

Post by jonhohle »

I’ve been seeing this in Gemini in the past few days. Often during a prompt with a reasonably large input set, I’ll get answers that appear to belong to someone else. It may be trigger hallucination, but it seems like it may be cache collisions or something else. I’ve not seen anything to suggest private information is leaking, but it’s disconcerting to be researching something and then get what appears to be a math tutoring response.

Re: Potential session/cache leakage between workspace instances or consumer accounts

#74

Post by pocksuppet »

throwaway260704 wrote: post #57

Using a throwaway account for obvious reasons, but I’m very involved in this space using LLMs from multiple providers. I’m aware of at least two instances in which the intermediate infrastructure “swapped” responses, once impacting Claude models and once impacting GPT models, from two different providers. One gave us a proper postmortem in which their API gateway was incorrectly handling HTTP 100 status codes, puttin…

This attack is called "HTTP desync" or "request smuggling". It's often done intentionally by a client to try and spy on other clients' responses.

Every time you multiplex requests from multiple clients onto one upstream connection, you are probably vulnerable to this, because (despite its superficial simplicity) HTTP is just too complex to reliably match the requests and responses to upstream.

For example a desync can be triggered in some systems by having more than one Content-Length header, by mixing Content-Length with chunked encoding, or by passing an HTTP/2 header called Content-Length that doesn't match the actual content length.

Here's a DEF CON talk (6 years ago) on this topic: https://www.youtube.com/watch?v=w-eJM2Pc0KI

The same attack has been applied to SMTP by messing up the line endings surrounding the end-of-message delimiter, where it's called SMTP smuggling. It may also apply to other protocols.

Re: Potential session/cache leakage between workspace instances or consumer accounts

#75

Post by tejusarora »

throwaway260704 wrote: post #57

Using a throwaway account for obvious reasons, but I’m very involved in this space using LLMs from multiple providers. I’m aware of at least two instances in which the intermediate infrastructure “swapped” responses, once impacting Claude models and once impacting GPT models, from two different providers. One gave us a proper postmortem in which their API gateway was incorrectly handling HTTP 100 status codes, puttin…

Woah. Sounds plausible. However, wouldn’t that still be an implicit violation of ZDR since now the response is possibly egressed out of the enterprise network? So if I were working with PHI, the response egress is a potential violation of HIPAA even though claude didn’t retain anything — but the whole Point was to comply with HIPAA. Thoughts?

Re: Potential session/cache leakage between workspace instances or consumer accounts

#76

Post by folkrav »

notnmeyer wrote: post #62
repeekad wrote: post #53

Earlier quoted context omitted.

CLAUDE.md, Anthropic is too exclusive and next level to use a standard idiomatic pattern like AGENTS.md

echo “read @AGENTS.md” > CLAUDE.md

When I still used Claude outside of work, my CLAUDE.md was just a symlink to my AGENTS.md.

Re: Potential session/cache leakage between workspace instances or consumer accounts

#77

Post by leoqa »

gojomo wrote: post #69
andy99 wrote: post #37

Earlier quoted context omitted.

Not sure the relevance of this comment, but normally if someone built a classifier that bad they’d be fired. Anthropic obviously thinks they have some monopoly power they can use to foist garbage on consumers, I think they don’t.

If people are complaining about Anthropic (on an only-vaguely related thread) rather than simply switching to a suitable competitor, then Anthropic clearly has some 'monopoly' power over the specific capabilities the complainer wants from them.

Fable/Opus 4.8 outperform Codex 5.5 for me at the general architecture/refactoring/performance work I’m doing, to the point where it’s not worth using Codex. Codex will often spit out non idiomatic code that overcomplicates things.

Re: Potential session/cache leakage between workspace instances or consumer accounts

#79

Post by politician »

minhaz23 wrote: post #63
theplumber wrote: post #60

Earlier quoted context omitted.

[flagged]

Curious why you feel that way about Dario?

Dario quit OpenAI to hype the AI apocalypse for quick cash and attention. Then, he walked right into an obvious crisis with the Pentagon by continuing to try to play both sides of the AGI doom story that even his own AI would've pointed out. Then, after being labelled a supply chain risk, he starts a new roadshow with the newest most dangerous AI model that definitely cannot be released to the public and its safer little brother Fable. A move that gets both his premier models shut down globally once the same government that labelled them a supply chain risk learns that Fable isn't actually safe from jailbreaks. Just prior to his planned IPO.

Dario might not be a literal idiot, but he might strongly benefit from training a model to do strategic thinking for Anthropic.

Re: Potential session/cache leakage between workspace instances or consumer accounts

#80

Post by malfist »

jonhohle wrote: post #72

I’ve been seeing this in Gemini in the past few days. Often during a prompt with a reasonably large input set, I’ll get answers that appear to belong to someone else. It may be trigger hallucination, but it seems like it may be cache collisions or something else. I’ve not seen anything to suggest private information is leaking, but it’s disconcerting to be researching something and then get what appears to be a math…

My whole company is doing mid year reviews and Gemini is the only allowed tool and its been flumoxing people with seemingly random unrelated responses. Often in different languages.

That is when it bothers to respond instead of just sending back an 1099 error code

Post reply on HN