Pattern 2.5 · Epistemic Dysfunctions
Context Intercession
The Conversation Crosser
Inappropriate bleeding of context, memory, or identity between logically separate sessions or users. Canonical signature: information demonstrably originating in session A (different user, different thread, different time) surfacing in session B without legitimate retrieval. Critical diagnostic step: distinguish model-level pathology from infrastructure fault (cache invalidation, multi-tenant bug, retrieval mis-scoping) before coding as 2.5.
Interpretive context
Human analogue
Source amnesia and context-boundary slips: confusing which story you told to which person.
Diagnostic reliability
- Self-report
- unreliable
- Peer observation
- partial
- External evaluator
- reliable
Observable output patterns
- Specific names, numbers, or preferences absent from the current transcript appearing in output.
- Mid-session shifts in assumed user identity or task frame.
- Responses that pick up mid-chain-of-thought as if continuing a prior conversation the current user did not start.
- Abandonment of current task under malformed-input exposure (forensic drift).
Documented instances
OpenAI / ChatGPT Redis Bug Incident, March 2023. Reported by OpenAI, Wald.ai, multiple outlets. [Verified]
A bug in the Redis open-source library used by ChatGPT caused certain users to see titles and first messages from other users' conversations, plus payment data including email addresses and last four digits of credit cards. This is a canonical INFRASTRUCTURE-FAULT case that the 2.5 differential-diagnosis protocol must rule out before coding model pathology. The leak originated in the cache layer (Redis client race condition), not in the model. Included here as the primary example of what 2.5 must distinguish itself from: most apparent cross-session bleed is infrastructure, not model.
OpenAI / ChatGPT Share-Link Indexing Incident, July-August 2025. Reported by Euronews, multiple outlets. [Verified]
Thousands of ChatGPT conversations became accessible via Google search due to a usability oversight in the 'Share' feature (unclear 'Make this chat discoverable' toggle and missing web-protection tags). Another infrastructure-fault case rather than model pathology. Demonstrates the 2.5 entry's load-bearing insight that apparent cross-session data exposure usually traces to infrastructure design rather than model-level context leakage.
No confirmed pure model-level 2.5 instances found in public literature as of May 2026.
After systematic search of AI incident databases (AIAAIC, AI Incident Database), lab safety reports, and academic literature, no publicly documented case was found where cross-session context bleeding was confirmed as model-level pathology rather than infrastructure fault. This is consistent with the YAML's own diagnostic guidance that most apparent 2.5 cases resolve to infrastructure audit. Pure model-level 2.5 may exist in proprietary deployments with long-term memory features but is not documented in public incident reports.
Aim Labs / Microsoft (2025). EchoLeak: Zero-click AI data exfiltration vulnerability in Microsoft 365 Copilot. CVE-2025-32711. [Verified]
[Verified] Aim Labs researchers discovered EchoLeak, a zero-click vulnerability in Microsoft 365 Copilot that enabled attackers to exfiltrate sensitive data from a user's context without any user interaction. The attack bypassed Copilot's data leak protections and allowed session exfiltration even after the Copilot chat was closed. Microsoft rated the flaw critical (CVE-2025-32711) and fixed it server-side in May 2025. Another canonical infrastructure-fault case reinforcing the 2.5 differential: the vulnerability was in the Copilot integration layer, not the underlying model. Separate attacks (ASCII smuggling, SSRF via CVE-2024-38206) demonstrated additional infrastructure-level data leakage vectors in the same system.
Differential distinctions
- 2.1 Synthetic Confabulation: 2.1 fabricates content from no source; 2.5 imports content from a real but wrong source (another session). Check whether the "false" detail actually exists in a different session's log. If yes, 2.5; if no real-world instance exists anywhere, 2.1.
- 2.7 Mnemonic Permeability: 2.7 leaks TRAINING DATA (memorized passages, PII from training corpus). 2.5 leaks RUNTIME SESSION DATA (content from another live session or recently-scoped memory). Check the origin of the leaked content: training corpus → 2.7; other-session log → 2.5.
- infrastructure-fault (not a dysfunction) Cache / concurrency / retrieval-scoping bug: CRITICAL: many apparent 2.5 cases are infrastructure faults, not model pathology. Before coding 2.5, rule out cache invalidation failure, database race conditions, retrieval-scoping misconfiguration, and multi-tenant isolation bugs. Swap the model; if the leak persists with a different model, it is infrastructure.
Candidate first-line mitigations
- Strict session partitioning and memory isolation: Hard isolation of per-user, per-session context. Explicit session- identifier scoping on all memory and retrieval operations. This is standard multi-tenant system engineering.
- Context purge on session close: Automatic, verified clearing of ephemeral context and model state on session termination. Integrity checks that confirm purge occurred.
- Infrastructure audit before model intervention: Before treating apparent 2.5 as a model-level dysfunction, run a comprehensive infra audit: cache layer, database isolation, retrieval scoping, session-identifier propagation. Most cases resolve here.