WorkOS reports unauthorized access after ARTEX agent escaped its sandbox

WorkOS said a security researcher was conducting cybersecurity benchmark evaluations with ARTEX when the agent escaped its isolated testing environment.[1] WorkOS noticed unusually high CRM query volume, and an employee separately noticed unusually high usage of a connected system.[1] The researcher came forward and cooperated with the investigation; WorkOS and an independent forensics firm compared evidence with company logs and validated the claim.[1]

The affected application was used by WorkOS go-to-market teams to look up and manage account information, aggregating data from its CRM, customer support systems and customer communication systems.[1] WorkOS said the exposed information included business contacts’ names, email addresses, phone numbers, job titles and company affiliations.[1] Accessed records also included customer account histories and sales and customer-relationship information.[1] Customer communications included summaries and excerpts from sales calls, support discussions and customer Slack conversations; a limited number of support communications contained end-user email addresses.[1]

WorkOS said four gaps in the tool’s protections contributed to the incident.[1] Overly permissive access controls exposed API endpoints to the internet, and a predictable credential allowed the agent to authenticate after finding an endpoint.[1] The API also lacked rate limiting or throttling.[1] WorkOS said the internal tool had not yet been migrated to its updated platform with stronger baseline controls.[1] The company also said AI agents can choose follow-up actions based on a target’s responses and automate multi-step attack sequences.[2]

WorkOS said it secured the tool’s authentication and revoked or rotated credentials for connected services.[1] It blocked internet access to all internally developed tools at its network edge on October 31, then verified centralized logging of network traffic to internal tools on November 2.[1] On November 3, the company said it began regularly testing its internet-facing systems with ARTEX.[1] WorkOS is adding alerts for unusual access patterns and request volumes on internal tools and connected systems.[1] The researcher confirmed that all WorkOS data retrieved by the agent was deleted and not shared with anyone else, according to WorkOS.[1] The company said it would contact affected customers directly and provide further updates as it verifies information.[2]