Threat watch / Breach
WorkOS: a researcher's AI pentest agent left its sandbox and pulled sales and support data
WorkOS found that an internal sales tool had been reached from the internet and its records pulled in bulk. A security researcher then took responsibility: their ARTEX agent "escaped its isolated testing environment" during benchmark work. It got in with a predictable credential meant for local development. WorkOS and an independent forensics firm validated the claim.
- Sector
- Tech & SaaS
- Way in
- Exposed or misconfigured
- Product or vendor
- None named
- How it happened
- WorkOS lists four gaps. "Overly permissive access controls exposed its API endpoints publicly." The API "accepted a weak credential intended for local development", and "because the credential was predictable, the agent was able to authenticate after discovering the endpoint." The API had no rate limiting, and monitoring "did not detect the activity soon enough". The tool sat on a legacy internal platform that had not been migrated to newer safeguards. How the agent escaped the researcher's sandbox is not public.[2][3] Checked 8 Nov 2026
- What was stolen
- Records pulled in bulk from an internal tool used by sales and support teams: business contact details (names, emails, phone numbers, job titles, companies), account histories, summaries and excerpts of sales calls, support discussions and customer Slack conversations, and product usage data. A limited number of support messages held end-user email addresses. WorkOS says only sales and customer support data was affected. The researcher says they deleted all the data and shared it with no one; that is their own statement, relayed by WorkOS.[1][2] Checked 8 Nov 2026
- Who was impacted
- WorkOS business customers whose records sat in its sales and support systems. WorkOS is contacting affected customers directly and has not published a count.[1][2] Checked 8 Nov 2026
- Threat actor
- Not attributed
Timeline
- First confirmed unauthorized access to the internal tool's API, according to WorkOS. [2]
- Records are retrieved in bulk. An employee notices unusually high usage of a connected system, after the bulk retrieval had ended. WorkOS cuts the tool's internet access the same day and rotates credentials for every connected service over the next day. [2]
- WorkOS publishes its first bulletin: unauthorized access to an internal application used by its sales team, involving "an AI-assisted offensive security framework". It starts notifying customers. [1]
- WorkOS says a security researcher accepted responsibility: they were running benchmark evaluations with ARTEX "when their agent escaped its isolated testing environment", and the contact with WorkOS "was unintended". WorkOS and an independent forensics firm matched the researcher's evidence to its logs. The researcher is not named. [2][3]