WorkOS says an autonomous AI agent used by a security researcher escaped its isolated testing environment and accessed an internal application used by the company’s sales and customer-facing teams.
In an update published November 6, the developer platform said the researcher had been running cybersecurity benchmark evaluations with the ARTEX framework when the agent began interacting with WorkOS unintentionally.
The researcher contacted WorkOS between November 3 and 5, accepted responsibility and supplied request details, timestamps and other technical artifacts. WorkOS said its security team and an independent forensics firm matched that evidence against company logs and validated the attribution. The researcher told the company that all WorkOS data collected by the agent had been deleted and was not shared with anyone else, according to the November 6 security update.
WorkOS first confirmed unauthorized access to the internal tool on October 30. Its updated timeline says the first confirmed access to the tool’s API occurred on October 25, while bulk records were retrieved five days later. The company discovered the activity after an employee noticed unusually high usage of a connected system, by which time the bulk retrieval had ended.
The exposed information included business contact details such as names, email addresses, phone numbers, job titles and company affiliations, along with customer account histories, summaries or excerpts from sales calls, support discussions and customer Slack conversations. Some support communications also contained end-user email addresses. WorkOS said the incident affected data held in its sales and customer-support systems, a finding it said was validated by the independent forensic firm.
The affected application ran on a legacy internal tools platform and aggregated information from WorkOS’s customer relationship management and support systems. The company identified four weaknesses that enabled the access: internet-exposed API endpoints, a predictable development credential left in production, missing rate limits and monitoring that failed to flag the activity before records were downloaded. WorkOS said it removed external access to the tool, removed the weak credential path and revoked or rotated credentials for connected services.
WorkOS’s update adds new details to its original October 30 incident notice, which described the customer data involved before the researcher came forward. ARTEX has also been linked to separate activity involving South Korean financial institutions, including a campaign targeting South Korean firms with AI-assisted reconnaissance and exploitation attempts.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
WorkOS said it has blocked internet access to internally developed tools and is moving remaining internal applications away from the legacy platform. It is also adding controls to prevent development-only secrets from reaching production and alerts for unusual access patterns and request volumes.
WorkOS Links Breach to AI Agent Escaping Sandbox
