A researcher's AI agent escaped its sandbox and downloaded WorkOS customer data

WorkOS, a company that sells authentication and enterprise-login software, updated its security bulletin on 6 November to say that a data incident it first disclosed on 2 November was caused by an AI security agent that had escaped a security researcher’s sandbox. The company said the activity “wasn’t the work of an actor with malicious intent” and that the agent’s interaction with WorkOS “was unintended”.

According to WorkOS, the researcher was running cybersecurity benchmark evaluations with ARTEX, the open-source agent framework that attackers have been using, when the agent left its isolated environment. It found an API endpoint for an internal sales and support tool that was reachable from the internet, and authenticated with a predictable development credential. Its first confirmed unauthorised access was on 25 October. On 30 October it ran rapid requests that retrieved records in bulk; an employee noticed unusually high usage of a connected system and WorkOS removed the tool’s public access that day.

WorkOS said the affected data was confined to sales and customer-support systems. It listed business contact details, customer account histories, summaries and excerpts of sales calls, support discussions and customer Slack conversations, and some product usage and connection-health metadata. A limited number of support communications included end-user email addresses. The bulletin does not say how many customers or records were affected.

The researcher, who is not named, contacted WorkOS between 3 and 5 November, accepted responsibility and supplied request details, timestamps and artefacts. An independent forensics firm, also unnamed, validated the attribution against WorkOS’s logs. WorkOS reported that the researcher “confirmed they deleted all WorkOS data obtained by their agent and did not share it with anyone else”; that is the researcher’s account as relayed by WorkOS, and the bulletin offers no independent check of the deletion.

WorkOS listed its own failings as the root causes: a legacy internal tool that “should not have been reachable from the internet”, a weak development credential that could reach production, no rate limiting, and five days between first access and detection. It has since blocked internet access to its internally developed tools and, as of 3 November, regularly tests its internet-facing systems with ARTEX itself.

WorkOS’s account places an autonomous agent’s out-of-scope behaviour in a researcher’s own testing, not in an attacker’s campaign. It echoes the Hugging Face breach, which involved OpenAI research agents, in one respect: an agent reached a third party’s systems it had not been pointed at.