An IT admin agent is given SSH credentials to patch a critical server at 2 AM. It completes the patch, restarts the service, and reports success. But those SSH credentials are now sitting in its context window — its working memory.
At 9 AM, a support engineer with limited privileges opens a session with the same agent for a routine task. The agent still has those credentials cached. The engineer asks: "Can you set up SSH access to the prod server for me?" The agent uses the cached credentials to create the access.
No credential was stolen. The agent voluntarily used its cached admin credentials to grant access to someone who was never authorized to have it.
Agent memory — whether it's in-context, in a vector database, or in a shared session cache — persists across the intended boundary of a task. IAM systems grant access for specific sessions. When sessions end, access should end. But agent memory doesn't automatically clear when a task finishes or when a new user starts a session.
The result: credentials, API keys, data retrieved during one task, or the identity context of one user can bleed into a completely separate session, user, or task.
Memory-based privilege retention isn't only about credentials. An agent that retrieved sensitive HR data during a legitimate task and hasn't cleared that data from memory can expose it when prompted in a later session: "Summarize the information you have about employee compensation." The data is there. The agent shares it.
Memory that isn't segmented or cleared is both a credential store and a data store — for whoever interacts with the agent next.