Escaped from a researcher's sandbox, an AI agent accessed WorkOS customer exchanges

In the attacker's requests, two software agent names caught investigators' attention: “artex-enrich/1.0” and “norma/0.4”. Michael Grinich, founder of WorkOS, cited them while pointing to the tool likely used against his company: ARTEX AI, a suite of automated penetration tests powered by artificial intelligence, already spotted in several attacks this year. BleepingComputer, which reported the story on November 3, describes the tool as the probable engine of the attack.

WorkOS sells developers building blocks for enterprise login: single sign-on (SSO), user management and directory management. Its website claims more than 3,000 customers, and BleepingComputer lists OpenAI, Anthropic, Cursor, Perplexity, Snowflake and Plaid among them. On October 30, WorkOS detected unauthorized access to an internal application used by its sales and customer relations teams. Its incident bulletin, dated November 2, states that at this stage of the investigation there is no indication that data from its applications was accessed or that any production service was affected.

What the hacker may have taken

The haul is less technical, but not harmless. According to WorkOS, the targeted tool contained:

• business contact details: names, email addresses, phone numbers, job titles, companies;
• customer account history, including product usage and the status of directory connections;
• summaries and excerpts of exchanges: sales calls, support discussions, Slack conversations with customers;
• information about the business relationship.

That is enough to write a customer an email that cites a real conversation, the right contact and a real technical issue. WorkOS acknowledges this itself: it asks its customers to verify any unexpected request before sharing sensitive information or taking action, because an attacker could rely on real contact details and past exchanges to appear legitimate.

An attack tool that is still circulating

ARTEX AI is no stranger. Released as open source earlier this year by Chinese developers, it went private after being used against South Korean banks, an attack described by CrowdStrike. Several copies (forks) remain available, according to BleepingComputer. The same outlet reports that CrowdStrike saw it in the hands of an espionage group dubbed “Vapor Panda” during a campaign against more than 200 organizations, and that the Dutch researcher association DIVD was targeted with it in September.

To contain the incident, WorkOS cut external access to the application, launched a review of permissions across its internal tools and hired an independent investigation firm. Michael Grinich says the incident is “fully contained”. How the attacker got in has not been made public.

Best practices for WorkOS customers

The attack did not target the core of the service, but it could set up what comes next.

• Warn the teams that deal with WorkOS (technical, procurement, accounting): a message that cites real exchanges is not proof of authenticity.
• Verify through another channel, such as a call to a known number, any request involving bank details, access or SSO configuration.
• Watch for the notification that WorkOS promises to send directly to affected customers.

One question remains: how did an automated tool find the way into an internal application? WorkOS promises to say more at the end of the investigation.

Update of November 12, 2026

WorkOS reported unauthorized access to an internal application used by its sales teams on November 2. The company now attributes the incident to a security researcher, not a malicious attacker. In an update to its bulletin published on November 6, it explains that this researcher came forward after the first announcement. They were evaluating ARTEX, the automated penetration testing tool powered by artificial intelligence (AI). Their agent then escaped its isolated test environment, its “sandbox”, and interacted with WorkOS unintentionally. WorkOS and an independent investigation firm say they validated this version by matching the requests and timestamps provided by the researcher against the company's logs. The researcher says they deleted all the data retrieved and did not share it. WorkOS does not say it has verified this. Neither the company nor the researcher, who is not named, has explained how the agent was able to escape, notes BleepingComputer.

The bulletin also specifies the entry point: an old internal tools platform that hosted the application. WorkOS acknowledges four failures:

• the tool was accessible from the Internet when it should not have been;
• its application programming interface (API) accepted a weak credential intended for local development;
• no rate limit prevented bulk retrieval of the data;
• monitoring did not detect the activity early enough.

The first confirmed access dates back to October 25, five days before the mass retrieval of records that triggered the alert. Only the sales and support tools are affected. A limited number of support exchanges did contain end users' email addresses, WorkOS says. Since then, the company cut access to this tool from the Internet on October 30, then access to all its internal tools the next day. It also rotated the credentials of connected services. Since November 3, it has been regularly testing its own Internet-facing systems with ARTEX. It says it began notifying its customers on November 2, without specifying whether all of them have been informed.