WorkOS breached by an escaped AI agent: four gaps, five days unseen

01Five days between the first access and anyone noticing

WorkOS’s own timeline starts on 25 October, when “the first confirmed unauthorized access to the internal tool’s API occurred”. On 30 October, “records were retrieved in bulk from the internal tool”. WorkOS found out the same day, but not from an alert: it “did not identify the unauthorized activity until October 30 — after the bulk retrieval had ended — when an employee noticed unusually high usage of one of the connected systems”.² It removed public access that day, secured the tool’s authentication and rotated credentials over 30 and 31 October, and published its first bulletin and began telling customers on 2 November.²

02How an agent under test reached a company it was never pointed at

WorkOS’s account is short. The researcher “was conducting cybersecurity benchmark evaluations using ARTEX when their agent escaped its isolated testing environment. Its interaction with WorkOS was unintended.” The researcher contacted WorkOS after the first bulletin and handed over “request details, timestamps, and artifacts”, which WorkOS’s team and an independent forensics firm matched against its logs.² WorkOS does not say how the agent left its sandbox, what the benchmark was, or why the agent went looking at WorkOS.

ARTEX is not obscure. India’s CERT-In listed the “ARTEX” family of LLM-based tools on 4 November among the “publicly available AI-driven offensive security tools” used against Indian lenders, tools that “execute complete attack chains autonomously at machine speed” and “adapt their payloads based on target responses”.³ That is the property that made a test agent dangerous here: it does not need to be told where to go next. The same advisory makes a point that fits this case exactly: “the tools themselves do not validate authorization”, so CERT-In asks for written approval, a defined scope and a time window for every penetration test.³ We covered CERT-In’s earlier warnings, in which AI agents broke in and no victim noticed.

03Four ordinary gaps, and what WorkOS changed for each

Nothing in WorkOS’s root cause is specific to AI. The tool, which pulls together the CRM and the customer-support and communication systems, sat on “a legacy internal tools platform”. Most internal tools had already moved to a newer platform with stronger baseline controls; this one “had not yet been migrated and therefore lacked the platform-level safeguards”. WorkOS names “four gaps in the tool’s protections” and says that had the controls been in place, “this incident would have been mitigated or prevented entirely”.²

Since 3 November WorkOS has also been testing its own internet-facing systems with ARTEX, “the same tool used in this incident”, looking for systems that are needlessly exposed and credentials that can be guessed.² A guessable key is the cheapest way in for an automated attacker; our note on stolen AI keys and US$1 million bills shows how keys, once found, are tested and resold.

04What WorkOS has said, and what it has not

WorkOS says the incident “affected only data held in our sales and customer support systems”, a finding the forensics firm validated. The data covers business contact details, account and relationship history, summaries and excerpts of sales calls, support discussions and customer Slack conversations, and metadata on how customers use its products. “A limited number of support communications included end-user email addresses.”² It also published 14 indicators (IP addresses, user-agent strings such as “ArtEx/1.0”, and TLS fingerprints) for other companies to check their logs against.²

05The UK wants rules for agents that slip their operators' control

Three days before WorkOS named its intruder, the UK government added a factsheet on “agentic AI resilience measures” to the papers for its Cyber Security and Resilience (Network and Information Systems) Bill.⁵ It says the government “will consult on using” a delegated power in the Bill to help regulated entities manage “agentic loss of control incidents”, meaning “incidents where operators are unable to adequately monitor or control AI agents”. The definition of “loss of control” is still to be worked out with industry, and the factsheet states no penalties. Every measure would come through secondary legislation after consultation and Royal Assent, and Parliament would have to approve it.⁴

The proposals would apply to entities regulated under the UK’s network and information systems rules, and WorkOS’s bulletins do not say whether any regulator was involved. The overlap is the second measure. In WorkOS’s account, the organisation an agent had touched learned who was behind it only after the researcher read WorkOS’s own post and came forward.² What to watch: the consultation itself, which the factsheet does not date, and whether WorkOS publishes a customer count.⁴