Bug: Variables exposed across instances

I am making a space with Gradio that lets a user input an API token to access additional functionality. This is set as a global variable and I would not expect it to be saved across sessions. I noticed today that this token is available across multiple instances, even if the other user is not logged in! Effectively the state of the Space is being shared between multiple unrelated users. This can’t be expected behavior, can it?

Person 1 uses gradio through the UI on spaces and sets token
Person 2 can use / access Person 1’s token.