WorkOS attributes customer data breach to a researcher's AI agent

WorkOS said a security researcher's AI agent, which the researcher says escaped its testing environment, accessed the company's internal sales tool and customer data, in an update to its November 2 incident post.

The tool aggregates data from WorkOS's CRM and its customer support and communication systems. Exposed records include business contact details and excerpts of customer calls and Slack conversations, according to the company's update bulletin1.

WorkOS's November 2 post2 said only that an AI-assisted offensive security framework had been used and that the investigation was ongoing. The update names the framework as ARTEX. It says the researcher, who contacted WorkOS after that post and accepted responsibility, was running cybersecurity benchmark evaluations when the agent left its isolated environment, and that the contact with WorkOS was unintended. The bulletin relays the researcher's account and does not name the researcher or the independent forensics firm.

The bulletin gives this timeline: the first confirmed unauthorized access to the tool's API was on October 25. Records were retrieved in bulk on October 30. WorkOS said it did not detect the activity until that day, after the bulk retrieval had ended, when an employee noticed unusually high usage of a connected system. Customer notification began November 2. Between November 3 and 5, the researcher supplied request details, timestamps and artifacts, which WorkOS and the forensics firm correlated with WorkOS logs.

WorkOS said the investigation found only data in its sales and customer support systems was affected, and that the forensics firm validated this. The exposed information included names, email addresses, phone numbers, job titles and company affiliations; customer account histories; summaries and excerpts of sales calls, support discussions and customer Slack conversations; and data on customers' use of WorkOS products. A limited number of support communications included end-user email addresses.

WorkOS listed four gaps. The tool ran on a legacy internal platform and was reachable from the internet through overly permissive access controls. Its API accepted a predictable development credential that had reached production. The API had no rate limiting. Monitoring failed to flag the activity soon enough.

WorkOS said the researcher confirmed deleting all data the agent obtained and not sharing it. The bulletin does not say WorkOS independently verified the deletion.

The company said that on October 30 it removed internet access to the tool, and that by October 31 it had rotated credentials and blocked internet access to all internally developed tools at its network edge. On November 3 it began regularly testing its internet-facing systems with ARTEX. As of November 5, it was still moving remaining internal applications to an updated platform, blocking development-only secrets from production and adding alerts for unusual access volumes.

The bulletin also says recent reporting from Wiz, Google and CrowdStrike shows AI agents built with ARTEX are increasingly used in intrusions. The bulletin does not give a publication date.