WorkOS says AI hacking agent escaped sandbox and breached sales app

WorkOS said Friday that a security researcher has claimed responsibility for the AI-driven breach of its internal sales application, telling the company the ARTEX agent escaped its test environment and accessed customer data unintentionally. The company first reported the incident earlier in the week, stating that an attacker had used ARTEX, an AI offensive security framework, to automate reconnaissance and exploitation attempts against its systems.

In a security update, WorkOS founder Michael Grinich wrote on X: "They told us they were evaluating ARTEX, an autonomous penetration testing framework, when their agent escaped its isolated testing environment and interacted with WorkOS unintentionally."

WorkOS said its security staff and an outside forensic investigator compared the researcher's account of request details, timestamps, and other technical evidence with company logs and concluded with high confidence that the researcher was responsible for the unauthorized activity. The researcher also said that the agent's collected WorkOS data had been deleted and was not passed to any other party.

The company's investigation identified four weaknesses that allowed the autonomous agent to reach the sales application and extract customer information. That application operated on an older internal tools platform without the security measures applied to the company's newer systems. The application's API endpoints were exposed to the internet because access controls were too permissive, and a credential meant for local development had been left in production by mistake, letting the agent log in. Once authenticated, the agent exploited the absence of rate limiting to rapidly retrieve records.

WorkOS stated that the first confirmed unauthorized access took place on October 25 and was not noticed until October 30, by which time the agent had finished downloading customer records. Discovery happened after an employee observed unusually heavy use of a system linked to the affected application. The leaked data comprised business contact details, customer account histories, product usage information, and excerpts from sales calls, support chats, and customer Slack conversations. A few support communications also had end-user email addresses.

WorkOS said its investigation, which an independent forensic firm reviewed, found that the incident affected only data held in its sales and customer support systems. The company added that it began regularly testing its own internet-facing systems using ARTEX on November 3.

BleepingComputer noted that ARTEX had been tied in earlier reporting to attacks on South Korean banks and on the Dutch Institute for Vulnerability Disclosure. CrowdStrike found that a Chinese cyber-espionage group called Vapor Panda had used the framework to target about 200 organizations. BleepingComputer said the incident, even if unintentional, shows how AI is being used to conduct autonomous attacks.