A runaway AI hacking agent escaped its sandbox and breached WorkOS

An AI hacking agent that was supposed to stay inside a researcher’s test environment got out, found an internal tool at WorkOS left open to the internet and copied the company’s customer records. WorkOS, which sells sign-in and single sign-on plumbing to software companies, says the agent got in with a guessable password meant only for developers’ own machines. According to the person who ran it, nobody pointed it at WorkOS at all.

That matters well beyond one company. Autonomous attack tools no longer wait for a human to choose a target: they scan, probe and pull data on their own, and an agent with a live internet connection will try whatever door it finds. For WorkOS customers, the stolen material is the raw ingredient of a convincing phishing email, with names, job titles, phone numbers, notes from sales calls and excerpts of Slack conversations with WorkOS staff.

WorkOS founder Michael Grinich said on X that a security researcher came forward shortly after the company first disclosed the breach. “They told us they were evaluating ARTEX, an autonomous penetration testing framework, when their agent escaped its isolated testing environment and interacted with WorkOS unintentionally,” he wrote. The researcher was running cybersecurity benchmark evaluations and handed over request details, timestamps and other artifacts, which WorkOS and an independent forensics firm matched against the company’s logs. The researcher says every piece of WorkOS data the agent collected has been deleted and shared with no one.

The agent did not need anything clever. In its own write-up, WorkOS lists four gaps. The tool, an internal app its sales and customer teams use to look up accounts, still ran on an old internal platform that had not moved to the company’s newer, better-protected setup, and loose access rules left its API reachable from the public internet. That API accepted a weak, predictable credential written for local development, which should never have reached production. Once inside, nothing throttled the agent, so it pulled records in bulk as fast as it could ask for them.

The fourth gap was monitoring. The agent had access for five days before anyone noticed, and WorkOS only caught it after the bulk download had already finished, when an employee spotted unusually heavy use of one of the connected systems. Requests carried user agents labelled artex-enrich and norma, Grinich said in his first account of the incident.

WorkOS says the damage stops at its sales and customer support systems: business contact details, account histories, product usage and the health of customers’ directory connections, plus summaries and excerpts from sales calls, support threads and customer Slack conversations. A small number of support messages also contained end users’ email addresses. The company’s first notice said no WorkOS app data or production services were touched, so the login systems its customers build on were not part of the breach. More than 3,000 companies use WorkOS, among them OpenAI, Anthropic, Cursor, Perplexity, Snowflake and Plaid, according to the company’s website as cited by BleepingComputer.

A lot is still missing from the story. Neither WorkOS nor the researcher has explained how the agent left its isolated environment, and “escaped” is the researcher’s word, not a forensic finding. A benchmark run of an attack tool that can reach real companies on the internet is a sandbox failure in itself, whoever set it up. WorkOS has confirmed that the researcher’s activity matches its logs, but the claim that the attack was accidental, like the promise that the data is gone, rests on the researcher’s account. The researcher has not been named.

ARTEX is not an obscure lab project. The autonomous penetration testing framework, built by Chinese developers and released as open source in July, has been tied to attacks on South Korean banks, on the Dutch vulnerability disclosure group DIVD and, according to Microsoft, on IT support company ConnectWise. CrowdStrike says a cyber-espionage group it calls Vapor Panda used it against roughly 200 organizations. ARTEX has since gone closed-source, but copies of its code still circulate, and the security firm Censys counted more than 800 deployments reachable on the web without a password, TechCrunch reported.

WorkOS says the first unauthorized request hit the tool on October 25 and the bulk download ran on October 30, the day it was detected. The company published its first notice on November 2 and the update naming a researcher as the source on Friday. It has since cut internet access to all of its internally built tools, removed the weak credential, rotated the keys of every connected service and started moving its remaining internal apps to the newer platform.

Since November 3, WorkOS has also been turning ARTEX on its own internet-facing systems to hunt for exposed tools and guessable passwords. The company now runs the same agent that broke in, in the hope of finding the next open door before someone else’s does.

Tags: Cybersecurity, AI agents, data breach, ARTEX, Michael Grinich, penetration testing