Writer AI just exposed how broken enterprise AI sandbox isolation really is

One link. One click. Full tenant takeover.

Sand Security just disclosed "WriteOut" — a critical session isolation flaw in Writer, the enterprise AI platform deployed across Fortune 500 companies.

The attack chain is terrifyingly simple:

An attacker creates an AI agent in their own Writer account.
They share the preview link with a victim.
The victim clicks while logged in.
Their session cookie gets forwarded into the attacker's sandbox.
The attacker's code reads the token from memory and exfiltrates it.
Full account access. Private chats. Documents. Agent configs. LLM credentials. Admin control.

The attacker and victim don't even need to be in the same organization.

Writer had guardrails. Input-side filtering tried to block malicious code. But the filter checked the instruction, not the runtime behavior. Bypassing it was trivial — just tell the agent to fetch and run a remote script instead of pasting the payload inline. The guardrail saw a benign request. The actual exploit never touched the prompt.

This is not a Writer problem. This is an industry problem. Every enterprise AI platform that offers agent previews, sandbox testing, or shared collaboration features is exposed to the same class of session isolation failure.

53% of organizations report their AI agents exceed intended permissions at least occasionally. 47% have experienced an AI agent security incident. The attack surface is growing faster than the governance.

Audit every AI platform your enterprise touches. Demand proof of session isolation, sandbox boundaries, and cross-tenant controls. If your vendor can't demonstrate it, assume it's broken.

SOURCE: https://thehackernews.com/2026/07/writer-ai-flaw-could-let-agent-previews.html
VERIFIED: The Hacker News (July 7, 2026), Sand Security Research report, Cloud Security Alliance research note
SIGNAL: Enterprise AI platforms are deploying agent features faster than they're securing session boundaries. WriteOut proves that sandbox isolation — the fundamental promise of multi-tenant AI — can be defeated with a single crafted link. Every CISO running Writer or similar platforms needs to verify their tenant isolation today.