2026-07-07 · 2026-Q3
"WriteOut" Cross-Tenant Account Takeover in Writer AI
Which agent, run, or tenant is this?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
Writer enterprise generative AI platform, live agent preview feature
Impact
A logged-in user who clicked a shared agent preview link could have their account hijacked across organizational tenants, exposing private chats, documents, agent configurations, private models, connectors, and LLM credentials, with potential admin control
Root cause
Writer served agent previews from the same origin as the main app, so the browser auto-attached the user's session cookie and the proxy forwarded it into the attacker-controlled sandbox, breaking tenant isolation. Found by SAND Security; Writer moved previews to an isolated origin and stopped forwarding the session cookie, fixing it within 24 hours, with no customer data compromised
Sources
Catalog
Cite this: AgentProv incident record: "WriteOut" Cross-Tenant Account Takeover in Writer AI (2026-07-07). https://agentprov.com/incidents/2026-07-07-writeout-cross-tenant-account-takeover-in-writer-ai
Related
- Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
- Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
- Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run