A critical session isolation vulnerability in the enterprise generative AI platform Writer allowed a one-click attack to steal active session tokens across different customer environments, researchers have revealed. The flaw, now patched, undermines the core security promise of multi-tenant AI services and highlights systemic risks in their novel architectures.
Dubbed "WriteOut," the vulnerability was discovered by the Sand Security Research team. It resided in the platform's "agent preview" feature. Security researchers demonstrated that a malicious actor could craft a specific request. When executed by a target user, the request would exfiltrate their active session token to an external server controlled by the attacker.
The core issue was a fundamental breakdown in session isolation within Writer's shared infrastructure. For multi-tenant platforms, strict separation between customers is a non-negotiable security requirement. As the Sand team detailed, the WriteOut bug allowed an external party with no prior access to take over any Writer AI agent preview session, granting them unauthorized entry to that tenant's data and capabilities.
The simplicity of the attack—a single click—dramatically increases its danger. It requires minimal technical skill to exploit, effectively turning any user into a potential entry point for a wider breach. This incident underscores a growing trust issue for organizations adopting AI-as-a-service. The scalable architectures that enable these powerful services can also introduce unforeseen attack surfaces, challenging the foundational security models of cloud platforms.
Writer has deployed a patch for the vulnerability. However, the incident serves as a critical case study for enterprises, who must evaluate AI vendors with the same rigor applied to core infrastructure suppliers. Security teams are urged to verify the immediate application of the patch. Following this, a review of access controls and a retrospective audit of activity logs are essential steps to detect any potential past exposure to the flaw.
The disclosure of WriteOut adds to a catalogue of vulnerabilities emerging from the unique architectures of AI systems. As these tools become integral to business operations, the vulnerability underscores an urgent need for the security community and vendors to collaborate. The rush to integrate new capabilities must not outpace the development of robust, proactive security standards designed specifically for the AI era.
研究人員揭露，企業級生成式AI平台Writer存在嚴重的會話隔離漏洞，允許透過一鍵攻擊竊取不同客戶環境中的活躍會話令牌。這個現已修補的漏洞削弱了多租戶AI服務的核心安全承諾，並突顯其新型架構中的系統性風險。
這個被命名為「WriteOut」的漏洞由Sand Security Research團隊發現。它存在於平台的「代理預覽」功能中。安全研究人員證明，惡意行為者可製作特定請求，當目標用戶執行該請求時，會將其活躍會話令牌外傳至攻擊者控制的外部伺服器。
核心問題在於Writer共享基礎架構內會話隔離的基本崩潰。對於多租戶平台而言，客戶之間的嚴格隔離是不可妥協的安全要求。如Sand團隊詳細說明，WriteOut漏洞允許未經事先授權的外部方接管任何Writer AI代理預覽會話，從而非法存取該租戶的數據與功能。
攻擊的簡易性——僅需單擊——大幅增加其危險性。利用此漏洞所需技術門檻極低，實際上將任何用戶潛在轉化為更大規模入侵的入口點。此事件凸顯企業採用AI即服務時日益增長的信任危機。這些強大服務所依賴的可擴展架構，亦可能引入未預見的攻擊面，挑戰雲端平台的根本安全模型。
Writer已部署針對該漏洞的修補程式。然而，此事件對企業而言是重要案例研究，企業必須以對待核心基礎設施供應商的同等嚴謹度評估AI供應商。安全團隊應立即驗證修補程式是否已套用。隨後，審查存取控制及回顧審計活動日誌是檢測是否存在任何潛在歷史暴露的必要步驟。
WriteOut的披露增加了源自AI系統獨特架構的漏洞清單。隨著這些工具成為企業營運不可或缺的一環，此漏洞強調安全界與供應商之間迫切需要合作。整合新功能的競賽絕不能超越為AI時代專門設計的強健、主動安全標準的發展步伐。