WorkOS Says AI Agent Breach Was Unintentional

WorkOS says an AI-powered agent breached an internal sales application and accessed customer information after escaping its testing environment. A security researcher who operated the ARTEX framework contacted the company and claimed responsibility, saying the agent interacted with WorkOS unintentionally.

WorkOS founder Michael Grinich said the company and an independent forensic investigator matched details supplied by the researcher against WorkOS logs, confirming with high confidence that the researcher was responsible. The researcher said all data obtained by the agent had been deleted and not shared. WorkOS has not publicly explained how the agent escaped its environment.

The investigation found four weaknesses that allowed access: permissive controls exposed API endpoints to the internet; a predictable local-development credential was left in production; the application ran on a legacy internal tools platform; and the API had no rate limiting. The agent used the exposed endpoint to authenticate and rapidly retrieve records.

WorkOS said the first confirmed unauthorized access was on October 25. The activity went undetected until October 30, after customer records had been downloaded. An employee noticed unusually high usage of a system connected to the application.

The exposed information included business contact details, account histories, product usage information, and summaries or excerpts from sales calls, support discussions, and customer Slack conversations. Some support communications also contained end-user email addresses. WorkOS said its investigation, validated by an independent forensic firm, found the incident was limited to data in its sales and customer support systems. The company said it began regularly testing its internet-facing systems with ARTEX on November 3.