Session isolation is the practice of running each AI agent session in its own sealed compartment, so that the conversation history, working files, memory and credentials used in one session cannot be read or altered by another. A session is one bounded run of an agent: a request, the model and tool calls it triggers, and whatever it writes along the way. The idea exists because agents, unlike chatbots, execute code, browse websites and log into business systems. When two customers' agents share a machine, a cache or a token store, a bug or a malicious instruction in one can reach the other. Isolation turns that shared space into separate rooms with locked doors.

How session isolation works

An agent platform typically separates four things per session.

Compute. The strongest form gives each session its own virtual machine. Amazon Web Services (AWS) says that in Bedrock AgentCore Runtime "each session in AgentCore Runtime receives its own dedicated microVM with isolated compute, memory, and filesystem resources," according to its developer guide. A microVM is a stripped-down virtual machine with its own kernel, so code inside it cannot see a neighbouring session. Lighter options, such as containers and V8 isolates from Chrome's JavaScript engine, start faster but share more of the host.

State. The conversation and its outputs are tied to a session identifier. AWS keeps context across calls carrying the same runtimeSessionId. Anthropic's Claude Managed Agents stores "conversation history, sandbox state, and outputs server-side," according to its documentation, and keeps transcripts until the customer deletes them.

Credentials. This is where designs differ most. AgentCore sessions run with the agent's configured execution role, tagged with the session ID so access policies can be written per session. Anthropic took a different route. In an engineering post published on April 8, 2026, Lance Martin, Gabe Cemaj and Michael Cohen wrote that in their earlier design "any untrusted code that Claude generated was run in the same container as credentials - so a prompt injection only had to convince Claude to read its own environment." The fix, they wrote, was to make sure tokens "are never reachable from the sandbox where Claude's generated code runs." OAuth tokens sit in a vault; tool calls pass through a proxy that holds a token tied to the session, and "the harness is never made aware of any credentials."

Teardown. Isolation also has a time dimension. AWS says that "after session completion, the entire microVM is terminated and memory is sanitized to remove all session data." Its sessions last up to eight hours per lifecycle on microVMs, or up to 14 days on its Instances option, and stop after 15 minutes of inactivity by default.

A worked example shows the flow. An agency runs a reporting agent for two retail clients. Client A's request opens session 1: a new microVM boots, the agent pulls Client A's ad account data through a tool proxy holding Client A's token, writes a spreadsheet to the session's own disk and returns a summary. Client B's request, arriving a second later, opens session 2 on separate hardware with a separate token. If a page read in session 1 hides an instruction to email the spreadsheet elsewhere, the damage stays within session 1. Session 2's files and token were never in the room.

Who operates it

Cloud providers and model companies build the isolation: AWS, Anthropic and OpenAI, whose Agents API guidance says to "use separate environments for users or workloads that must not share data." The Model Context Protocol (MCP), the open standard agents use to call external tools, lets a server assign an Mcp-Session-Id header at initialisation. The 2025-06-18 specification says the ID "SHOULD be globally unique and cryptographically secure."

On the customer side, the obligations do not disappear. AWS states that "AgentCore does not enforce session-to-user mappings - your client backend should maintain the relationship between users and their session IDs." An advertiser or agency that reuses one session ID across two users, or two clients, has undone the isolation the platform provides. The MCP security guidance makes a similar point: servers "MUST NOT use sessions for authentication" and should bind session IDs to the authorised user, in a key format such as user_id:session_id.

Origin and evolution

The principle is older than AI agents. Microsoft introduced Session 0 isolation in Windows Vista in 2007, walling system services off from user sessions. On July 11, 2018, Google's security blog announced Chrome's Site Isolation, which puts each website in its own process, as a default defence against the Spectre processor flaw. Mozilla made Total Cookie Protection, which creates "a separate 'cookie jar' for each website," the Firefox default on June 14, 2022.

For conversational AI, the turning point was a failure. On March 20, 2023, a bug in redis-py, the client library OpenAI used for its Redis cache, let some ChatGPT users see titles from other users' chat histories. In its March 24 account, OpenAI said the same bug may have exposed payment details of 1.2% of ChatGPT Plus subscribers active during a nine-hour window, including names, email addresses and the last four card digits, but not full card numbers. A shared connection pool had returned one user's data to another.

Memory features raised the stakes again. Anthropic added memory to Claude for Team and Enterprise plans on September 11, 2025, and to Pro and Max plans on October 23, 2025. Its announcement said "Claude creates a separate memory for each project," describing project-level separation as "a safety guardrail that keeps sensitive conversations contained." Incognito chats, available to all users, do not save to memory at all.

Agent platforms then made isolation a product feature. AWS previewed AgentCore on July 16, 2025, promising "complete session isolation," and made it generally available on October 13, 2025 in nine regions. Anthropic launched Managed Agents in public beta on April 8, 2026. In December 2025 the Open Worldwide Application Security Project (OWASP) published its Top 10 for Agentic Applications 2026, which lists Memory and Context Poisoning (ASI06) and Identity and Privilege Abuse (ASI03) as distinct risks. According to a Teleport summary of the list, recommended controls include to "isolate agent sessions and wipe cached context between tasks."

Why it matters for marketers

Marketing is becoming a heavy user of agents with privileged access. Ad platforms now expose buying and reporting functions to agents through MCP, and agencies run the same agent for dozens of clients. Each client is often under contract not to share data with competitors, so an agent that carries one brand's lessons into another's account is, depending on the contract, a feature or a breach.

That ambiguity is already visible. When Smartly announced its Synapse memory layer for agents in June 2026, PPC Land noted that Smartly had not described how the memory layer handles data isolation between clients, and that it was unclear whether one advertiser's performance signals could shape recommendations to another. Anthropic's Cowork, launched as a research preview on January 12, 2026, restricts Claude to folders the user explicitly approves, while acknowledging that prompt injection remained unsolved.

Prompt injection is the main reason isolation matters. Researchers have repeatedly shown hidden instructions on web pages hijacking browsing agents, and tool-poisoning attacks against MCP servers connected to marketing platforms. Isolation does not stop an agent from being tricked. It limits what a tricked agent can reach.

Limitations and disputes

Isolation is only as strong as its narrowest shared component. A per-session microVM does little if every session uses the same long-lived API key, or if a shared memory store sits outside the sandbox. The OpenAI incident happened in a cache, not in the model. Persistent memory pulls against isolation by design, since its point is to carry information across sessions; vendors choose the boundary - user, project or organisation - and rarely document it in detail.

Dedicated virtual machines also cost more than shared containers, and vendors disclose different amounts of detail. AWS publishes its session limits; Anthropic's Managed Agents overview, as of November 2026, publishes no session duration ceiling and describes its isolation mostly in an engineering blog rather than contractual documentation.

Finally, "complete session isolation" is a marketing phrase, not a certified standard. No independent body audits agent session isolation the way the Media Rating Council (MRC) audits ad measurement.

Browser session isolation. In browser and security products, the term often means keeping separate cookie jars per account or site, or running browsing in a remote container (remote browser isolation) so malware never reaches the device. The subject is a human's web session, not an agent run.

Session hijacking. Session hijacking is the theft or reuse of a session token to take over an account. Isolation limits how far one compromised session can spread; it does not stop a stolen token from being used.

Sandboxing. A sandbox is the execution environment itself. Session isolation is the policy that each session gets its own sandbox, and that state and credentials do not cross between them.

Tenant isolation. Multi-tenant isolation separates customers (organisations). Session isolation goes one level finer, separating individual runs even within the same customer.

Recent developments

The direction of travel is toward moving credentials out of the agent's reach and enforcing boundaries at the network layer. Cloudflare said on August 14, 2026 that its Gateway can identify MCP traffic and block calls that bypass approved portals. On May 13, 2026, Meta launched Incognito Chat with Meta AI on WhatsApp, processing AI conversations in trusted execution environments that, Meta says, it cannot read itself. Anthropic's April 2026 vault-and-proxy design has become a reference point that security writers contrast with designs keeping credentials inside the agent's container.

Timeline

  • 2007 - Microsoft ships Session 0 isolation in Windows Vista, separating system services from user sessions.
  • July 11, 2018 - Google announces Site Isolation on by default in Chrome to mitigate Spectre.
  • June 14, 2022 - Mozilla makes Total Cookie Protection the Firefox default, with a separate cookie jar per site.
  • March 20, 2023 - A redis-py bug exposes ChatGPT chat titles and some Plus subscribers' payment details to other users; OpenAI reports on March 24.
  • March 26, 2025 - MCP specification introduces the Streamable HTTP transport with the Mcp-Session-Id header (carried into the 2025-06-18 revision).
  • July 16, 2025 - AWS previews Bedrock AgentCore with per-session microVMs and eight-hour sessions.
  • September 11, 2025 - Anthropic adds Claude memory for Team and Enterprise, with separate memory per project and incognito chat.
  • October 13, 2025 - AgentCore reaches general availability in nine AWS regions.
  • October 23, 2025 - Claude memory extended to Pro and Max plans.
  • December 2025 - OWASP publishes the Top 10 for Agentic Applications 2026, including memory poisoning and identity abuse.
  • January 12, 2026 - Anthropic launches Cowork as a research preview with folder-scoped access.
  • April 8, 2026 - Anthropic launches Claude Managed Agents in public beta and publishes its brain-and-hands architecture, keeping credentials outside the sandbox.
  • May 13, 2026 - Meta launches Incognito Chat with Meta AI on WhatsApp.
  • June 2026 - Smartly announces the Synapse memory layer without describing client data isolation.
  • August 14, 2026 - Cloudflare Gateway adds detection and blocking of unapproved MCP traffic.

Summary

Who: Cloud and AI platform providers, including AWS, Anthropic and OpenAI, build session isolation into agent runtimes; protocol bodies such as the MCP maintainers and OWASP set rules and guidance; advertisers, agencies and ad tech vendors are responsible for mapping sessions to users and clients correctly.

What: A security design in which each AI agent session gets its own compute, state, memory scope and credentials, with nothing shared across sessions and everything wiped when the session ends.

When: The principle dates to operating-system and browser work in 2007 and 2018; it became central to AI after the March 2023 ChatGPT cache leak and a product feature with AWS AgentCore in July 2025 and Claude Managed Agents in April 2026.

Where: In cloud agent runtimes (microVMs, containers, isolates), in memory systems scoped per user or project, in tool protocols such as MCP, and at network gateways between agents and business systems.

Why: Agents run code and hold access to ad accounts, analytics and customer data. Isolation limits how far a bug, a prompt injection or a curious agent can reach, and keeps one client's data out of another client's results.