SymptomA Finance Bot and a Marketing Bot can read each other's files, browser sessions and command-line credentials, and one Bot's leftover working file is read by another as fact.
CauseOne cloud computer is assigned per user account and shared by every Bot on it. Separate profiles, conversations, screens and role memories are routing and context boundaries, not confidentiality boundaries. Plugin connections are authenticated once and shared across the whole fleet, and saved skills are available to every Bot.
DetectionArchitectural, so it is present from the moment a second Bot exists. One six-agent business that tried to work around it with per-agent Chrome profiles reported the profiles resetting daily alongside frequent Chrome crashes.
FixIf one Bot must never reach a resource, keep that resource off the shared computer entirely. Use dedicated scoped service accounts rather than owner credentials. Sign out of services when not in use, since the browser session and not the password is what persists. Do not rely on Bot names as a security control.