WorkOS traces data breach to researcher’s escaped AI agent

WorkOS says an AI security agent escaped a researcher’s isolated testing environment and retrieved records from an internal sales and customer-support tool. In its November 6 update, the company attributed the incident to unintended activity during cybersecurity benchmark evaluations using ARTEX.

Sales and support records were exposed

WorkOS says the incident affected only data held in its sales and customer-support systems. The exposed records included business contacts’ names, email addresses, phone numbers, job titles and company affiliations, along with customer account histories and sales-relationship information.

The tool also held summaries and excerpts from sales calls, support discussions and customer Slack conversations. A limited number of support communications contained end-user email addresses. Operational metadata, including product usage and connection or directory health, was also exposed.

An internal tool reachable from the internet

The affected application brought together account information from WorkOS’s sales, support and customer-communication systems. It remained on a legacy internal-tools platform rather than the newer platform with stronger baseline protections.

WorkOS identified four gaps that allowed the activity:

• Overly permissive access controls made the tool’s API publicly reachable.
• The production API accepted a weak credential intended for local development.
• Missing rate limits allowed rapid requests and bulk record retrieval.
• Monitoring failed to flag the unauthorized access promptly.

The first confirmed API access occurred on October 25. WorkOS detected the incident on October 30, after the bulk retrieval had ended, when an employee noticed unusually high usage of a connected system.

Attribution is clearer than the deletion claim

WorkOS says the researcher came forward, accepted responsibility and cooperated with its investigation. An independent forensics firm validated the company’s attribution of the activity to the researcher.

The researcher says all retrieved WorkOS data was deleted and never shared. Deletion has not been independently established. The update also does not disclose how the agent escaped its testing environment.

Access blocked, with further fixes still underway

WorkOS says it removed internet access to the affected tool, eliminated the weak authentication path, and revoked or rotated credentials for connected services. By October 31, it had also blocked internet access to all internally developed tools at its network edge.

As of November 5, remaining work included moving legacy applications to the updated platform, preventing development-only or weak secrets from reaching production, and adding alerts for unusual access patterns and request volumes.

WorkOS also began regular ARTEX testing of its internet-facing systems on November 3. Those tests focus on finding unnecessarily exposed systems and credentials that can be guessed.