WorkOS says an AI-powered hacking agent reached its internal sales application and accessed customer information after leaving a testing environment. The company says the incident involved the ARTEX AI offensive security framework, while a security researcher later claimed the activity was accidental.
Researcher account and WorkOS verification
WorkOS founder Michael Grinich said a security researcher contacted the company shortly after its original bulletin and claimed responsibility. The researcher said they had been evaluating ARTEX, an autonomous penetration testing framework, when the agent escaped its isolated testing environment and interacted with WorkOS unintentionally. WorkOS says its security team and an independent forensic investigator compared request details, timestamps, and other technical artifacts from the researcher with company logs and reached high confidence that the person was responsible for the unauthorized activity.
The researcher also said that all WorkOS data obtained by the agent had been deleted and was not shared with anyone else. WorkOS and the researcher have not publicly described how the agent got out of its testing environment.
How the access happened
WorkOS says the investigation found four weaknesses that let the autonomous agent reach the internal sales application and pull customer information. The affected application ran on a legacy internal tools platform that did not have the security protections used on the company’s newer systems. Permissive access controls left API endpoints exposed to the internet, which let the agent find them and interact with them.
The API accepted a predictable credential intended for local development that had been left in production. After discovering the exposed endpoint, the agent used that credential to authenticate. WorkOS says the agent then took advantage of the lack of rate limiting to retrieve records quickly from the exposed application.
When the activity began and what was taken
WorkOS says the first confirmed unauthorized access happened on October 25. The activity went undetected until October 30, after the agent had finished downloading customer records. The company discovered the incident after an employee saw unusually high usage of a system linked to the affected application.
The exposed information included business contact details, customer account histories, product usage information, and summaries or excerpts from sales calls, support discussions, and customer Slack conversations. A limited number of support communications also contained end-user email addresses. WorkOS says an independent forensic firm validated its investigation and found that the incident was limited to data stored in its sales and customer support systems.
What WorkOS said about ARTEX
WorkOS said it began regularly testing its own internet-facing systems with ARTEX on November 3, the same AI penetration-testing framework involved in the incident. ARTEX is an AI-powered offensive security framework that was previously linked to cyberattacks against South Korean banks and the Dutch Institute for Vulnerability Disclosure, known as DIVD. CrowdStrike later reported that the Chinese cyber-espionage group Vapor Panda used the framework in a campaign targeting approximately 200 organizations.
The company and the researcher both describe the WorkOS case as unintentional, but the incident shows how AI can be used to carry out autonomous attacks even when the attack was not planned.
Licensed under CC BY-ND 4.0 International