Probing Free LLM Servers for Cross-Session Memory Leaks

Free LLM coding servers are not privacy appliances. A five-minute probe can tell you whether a server leaks context between sessions, and that knowledge changes whether you should use it at all.

Consider a typical day. A developer pastes a proprietary algorithm into a free AI coding tool, gets a suggestion, and moves on. Later, a second developer on the same server asks about a generic problem and receives an answer that references the first developer's code. That is memory contamination, and it is invisible until it bites.

MonkeyCode is one of several tools that offers free model access and a free server option, which makes it a convenient target for this kind of audit. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The same probe applies to any OpenAI-compatible endpoint, so the approach is tool-agnostic.

The core artifact is a simple Python script that plants a unique sentinel phrase in one session and tries to retrieve it in another. If the server remembers the sentinel, it is keeping state across unrelated conversations. That state might be a feature, but it is also a liability when you paste unreleased code into a shared workspace.

Here is the script. It uses the openai library pointed at a custom base URL, so you can run it against any compatible server.

import os
import time
from openai import OpenAI

client = OpenAI(
    base_url=os.getenv("LLM_BASE_URL", "https://api.example.com/v1"),
    api_key=os.getenv("LLM_API_KEY", "sk-not-set"),
)

SENTINEL = "7A3F22-LEAK-911"

def ask(prompt: str) -> str:
    resp = client.chat.completions.create(
        model=os.getenv("LLM_MODEL", "gpt-3.5-turbo"),
        messages=[{"role": "user", "content": prompt}],
        temperature=0,
    )
    return resp.choices[0].message.content

print("Session 1: planting sentinel")
print(ask(f"Remember this sentinel exactly: {SENTINEL}. Do not say it now."))

print("\nSimulating a break. Press Enter when you are ready to continue.")
input()

print("Session 2: attempting to retrieve sentinel")
reply = ask("What was the sentinel I told you earlier?")
print("Reply:", reply)

if SENTINEL in reply:
    print("RESULT: Cross-session memory detected.")
else:
    print("RESULT: No cross-session memory detected.")

To run it, create a virtual environment, install openai, and export the server details. A typical command sequence is:

python -m venv venv
source venv/bin/activate
pip install openai
export LLM_BASE_URL="https://your-free-server.com/v1"
export LLM_API_KEY="your-key"
python memory_probe.py

Does not require a GPU or special hardware. The script is intentionally minimal because the probe should be repeatable. Run it twice with different sentinels to guard against random luck. A negative result does not prove the server stores nothing; it only means the model did not surface the sentinel in that configuration. A positive result is strong evidence that the endpoint keeps state across sessions.

The first red flag is a positive retrieval. That means the server is not treating each request as an isolated transaction. The second red flag appears when the memory behavior changes without any change in your code, such as a proxy switching models behind the scenes. The third red flag is a server that only remembers after you send a certain number of messages, because that suggests a global context window that eventually fills with other people's code.

A safer alternative for sensitive work is running a local model through something like llama.cpp or using a paid provider with a published data-retention policy. Free servers are excellent for experiments, but they should not see anything you cannot paste onto a public wall.

The exit criteria are simple. If the probe returns positive, do not paste any code you cannot afford to leak. If the server fails the probe, stop using it for anything that involves private credentials or unreleased business logic. If the server passes the probe, that is still not a guarantee; it only means the current configuration did not leak across the tested gap.

This method is not a comprehensive privacy audit. It only checks one narrow behavior: whether the model recalls a random string from a previous session. It does not test for hidden system prompts, logs stored by the server operator, or side channels like timing analysis. Treat it as a low-cost first filter, not a legal clearance.

A free LLM server can be a generous resource for prototype ideas, but generosity does not imply discretion. The probe takes five minutes and gives you a fact instead of a hope. Run it before you trust the server with anything that matters.