That’s because all file URLs point to the files.php
file. You should’ve added an exception for this file for attachments to work for Agents.
User sessions are only tied to Users and are completely separate from Agents.
We have reports of session issues which we are actively looking into.
Cheers.