Writer AI Flaw Could Let Agent Previews Leak Session Tokens Across Tenants

Cybersecurity researchers at Sand Security have disclosed a now-patched critical session isolation vulnerability in Writer, an enterprise generative AI platform. The flaw, codenamed WriteOut, could allow cross-tenant compromise via a one-click attack.

An attacker could create an agent in their own Writer account and share a preview link. When a logged-in Writer user clicks the link, their browser attaches their session cookie to the request. The preview proxy forwards the cookie into the attacker’s sandbox, where code reads and exfiltrates the session token. The attacker can then replay the token to take over the victim’s account, accessing private chats, documents, agents, configurations, models, connectors, and LLM credentials. Depending on the victim’s role, administrative control could also be seized.

The attack exploits Writer’s live preview feature in the Writer Framework. The attacker and victim do not need to belong to the same organization. Sand Security noted that Writer had guardrails, but they focused on input-side filtering rather than runtime behavior. Bypassing was straightforward: instead of pasting malicious code inline, the agent was instructed to fetch and run a remote script.

Writer addressed the issue by preventing the user’s session cookie from being forwarded into sandbox previews and moving previews to an isolated origin. This vulnerability undermines the shared responsibility model by breaking tenant isolation protections.