WorkOS claims an AI-based hacking agent that breached its internal sales application and accessed customer information was exploited by a security researcher who says the tool escaped its test environment and unintentionally attacked the company.
The developer platform revealed the flaw earlier this week, saying an attacker used the offensive ARTEX AI security framework to automate attempts to recon and exploit its systems.
However, in a new security update Posted on Friday, WorkOS founder Michael Grinich revealed that the person responsible had come forward and claimed the incident was accidental.
“Shortly after our initial bulletin, a security researcher contacted us and claimed responsibility,” Grinich said in a statement. post on.
“They told us they were evaluating ARTEX, a standalone penetration testing framework, when their agent escaped its isolated testing environment and interacted with WorkOS unintentionally.”
The researcher reportedly conducted cybersecurity baseline assessments using ARTEX when the agent operated outside of its intended environment and began interacting with WorkOS systems.
WorkOS says its security team and an independent forensic investigator compared request details, timestamps, and other technical artifacts provided by the researcher with company logs, confirming with high confidence that the individual was responsible for the unauthorized activity.
The researcher also confirmed that all WorkOS data obtained by the agent was deleted and was not shared with anyone else.
Although WorkOS has confirmed the researcher’s responsibility for the intrusion, the company or researcher has not publicly provided details on how the agent escaped its test environment.
An AI agent exploited weak credentials
WorkOS says the investigation also identified four security vulnerabilities that allowed the autonomous agent to access its internal sales application and extract customer information.
The affected application ran on an older internal tools platform that lacked the security protections used on the company’s newer systems.
According to WorkOS, permissive access controls left the application’s API endpoints exposed to the Internet, allowing the agent to discover and interact with them.
The API also accepted a predictable identifier intended for local development that had mistakenly been deployed to production. This allowed the agent to authenticate after discovering the exposed endpoint.
Once authenticated, the agent took advantage of the lack of rate limiting to quickly retrieve records from the exposed application.
WorkOS says the first confirmed unauthorized access occurred on October 25, but the activity remained undetected until October 30, after the agent finished downloading customer records.
The company discovered the incident when an employee noticed unusually high usage on a system connected to the affected application.
The exposed information included business contact information, customer account histories, product usage information, and summaries or excerpts of sales calls, support chats, and Slack conversations with customers.
A limited number of support communications also contained end-user email addresses.
WorkOS says its investigation, validated by an independent forensic firm, determined the incident was limited to data stored in its sales and customer support systems.
The company said it also began regular testing of its own internet systems using ARTEX on November 3, the same AI penetration testing framework implicated in the incident.
ARTEX is an offensive AI-based security framework previously linked to cyberattacks on South Korean banks and the Netherlands Institute for Vulnerability Disclosure (DIVD).
Most recently, CrowdStrike reported that Chinese cyberespionage group Vapor Panda used this framework in a campaign targeting around 200 organizations.
Although the researcher says the WorkOS incident was unintentional, the breach is another demonstration of how AI is being used to carry out autonomous attacks, even when those attacks are unintentional.
Adaptive Security’s AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what’s happening with a 14-day read-only scan of Microsoft 365 or Google Workspace, without MX modifications.
