Writer AI Flaw Could Let Agent Previews Leak Session Tokens Across Tenants
Summary: Sand Security Research disclosed a now-patched critical session isolation flaw in Writer, codenamed WriteOut, in which an attacker creates an agent in their own Writer account and shares a preview link that, when clicked by a signed-in victim at another organization, lets the attacker read the sandbox process's memory and exfiltrate the victim's session token. Writer said it fixed the issue within 24 hours of notification in May 2026 by removing session credentials from sandbox previews and moving them to an isolated origin, and reported no customer data compromised and no evidence of malicious exploitation.
Key Takeaway: The guardrail that failed inspected the instruction rather than runtime behavior, so a prompt telling the agent to fetch and run a remote script passed as benign while the exploit logic never appeared in the prompt at all. Tenant isolation broke with nothing more than a link, and the attacker and victim did not need to share an organization.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026