Here’s a nasty one in the enterprise AI space. Sand Security found a critical session isolation hole in Writer, the generative AI platform used by companies for document work and agent building.
They called it WriteOut. One click.
An attacker creates an agent in their own Writer account and shares a preview link. If someone clicks that link while logged into Writer — even a different organization entirely — their session cookie gets forwarded into the attacker’s sandbox. The sandbox code reads the token from memory and exfiltrates it. Attacker replays the token. Full account takeover.
Private chats, documents, agent configs, LLM credentials — all exposed. Depending on the victim’s role, the attacker could seize admin control. And you don’t need to be in the same organization as the target. Any Writer user can attack any other Writer user.
Sand Security found the guardrails were checking the wrong thing. Writer had input-side filters trying to block users from reading environment variables or submitting malicious code. But instead of pasting the payload inline, the researchers simply told the agent to fetch a remote script. The guardrail saw a benign “download and run” request. The actual exploit never appeared in the prompt.
Writer patched this after responsible disclosure. The fix: prevent session cookies from being forwarded into sandbox previews entirely, and move previews to an isolated origin.
If you use Writer, make sure you’re on the latest version. And this is a good reminder: AI agents that execute code inside managed sandboxes create a new attack surface. Guardrails that only check input, not runtime behavior, aren’t enough.
