Writer AI Flaw Could Let Agent Previews Leak Session Tokens Across Tenants

Cybersecurity researchers have disclosed details of a now-patched critical session isolation vulnerability in Writer, an enterprise generative artificial intelligence (AI) platform, that could result in cross-tenant compromise. The one-click vulnerability has been codenamed WriteOut by the Sand Security Research team. "An outsider could go from having no access to taking over any Writer AI

According to Sand Security’s WriteOut research and subsequent reporting, Writer’s agent live preview feature had a critical session isolation flaw that forwarded a logged‑in user’s session cookie into an attacker‑controlled sandbox when a malicious preview link was opened.[1][2] This allowed cross‑tenant account hijacking: replayed session tokens could grant access to private chats, documents, agents, configurations, private models, connectors, and LLM credentials, and in some cases full administrative control.[1][2] RealGround analysis: this is a SaaS AI platform risk centered on weak session isolation and unsafe agent preview architecture, showing that AI agent UX features can become high‑impact account takeover vectors across tenants. Organizations using AI SaaS should assess session/token handling in agent features, adopt stricter origin and sandbox isolation, and continuously red‑team agent flows to detect similar cross‑tenant compromise paths before exploitation.