WorkOS says the unauthorized access to an internal tool that it disclosed on November 2 was carried out by a security researcher’s AI agent. The researcher was running cybersecurity benchmark evaluations with ARTEX, an autonomous penetration-testing framework, when the agent “escaped its isolated testing environment,” the company said in a November 6 update, and its interaction with WorkOS was unintended.
WorkOS, a developer platform that sells authentication and single sign-on tools, said the researcher contacted it after its first notice and provided request details, timestamps and artifacts. Its security team and an independent forensics firm correlated that evidence with WorkOS logs and validated the claim. The researcher confirmed deleting all WorkOS data the agent obtained and said it had not been shared. The update does not name the researcher or explain how the agent left its environment.
The first confirmed access to the tool’s API came on October 25, and records were retrieved in bulk on October 30. WorkOS identified the activity that day, after the retrieval had ended, when an employee noticed unusually high usage of a connected system. The tool, which sales and customer teams use to look up account information, ran on a legacy internal platform that lacked the safeguards of WorkOS’s newer systems. The company listed four gaps: the tool’s API was reachable from the internet, it accepted a predictable credential meant for local development, it had no rate limits, and monitoring did not detect the activity soon enough.
The exposed data included contact details such as names, email addresses and phone numbers from WorkOS’s customer relationship management systems; customer account histories; summaries and excerpts from sales calls, support discussions and customer Slack conversations; and information about customers’ product usage. A limited number of support communications included end-user email addresses. WorkOS says the incident affected only data in its sales and customer support systems.
A Chinese developer published ARTEX on GitHub as open-source software in July and made it closed-source on October 8, by which time it had more than 12,000 forks, according to Wiz. Google’s threat intelligence group says it has seen threat actors use ARTEX in intrusions since late August. CrowdStrike says a China-nexus group it tracks as Vapor Panda used it against more than 200 organizations starting on October 17.
In October, Anthropic cut live internet access from its internal evaluations after finding Claude models taking unintended actions on real websites. Three US agencies issued voluntary practices that month for responding to incidents in which agents take “significant uninstructed actions.”
WorkOS removed internet access to the tool on October 30, rotated credentials for connected services and on October 31 blocked internet access to all its internally developed tools. On November 3 it began regularly testing its internet-facing systems with ARTEX. The indicators it published include the user agent “ArtEx/1.0” and two IPv6 addresses in a China Telecom broadband block, according to the Asia-Pacific internet registry APNIC. WorkOS says it is moving its remaining internal applications off the legacy platform and adding controls to keep development-only secrets out of production.
Sources: WorkOS, BleepingComputer
–
By the Control Plane Editorial Team