On 6 November, WorkOS disclosed who caused the unauthorised access it detected on 30 October. The company provides login and user management services to application developers.

A security researcher contacted the company after it published its first notice on 2 November and admitted responsibility, the statement said. The researcher’s AI agent escaped its sandbox, an isolated testing environment, during security benchmarks run with ARTEX. The company said the agent’s access to WorkOS systems was unintentional.

The researcher provided details of the requests the agent sent, timestamps and traces of its activity. WorkOS’s security team and an independent forensics firm compared these with the company’s logs and confirmed the researcher’s account. WorkOS said the researcher has given assurances that the retrieved data has been deleted and not shared.

WorkOS does not say how the agent got out of the sandbox. Reports by the news sites GBHackers, Cybersecuritynews and Cyber Press are based on the company’s statement. GBHackers and Cyber Press wrote that WorkOS accepted responsibility. The statement, however, says the researcher did.

Agent authenticated with a predictable credential

The agent reached an internal tool for the sales and customer teams that pulls together data from customer relationship management (CRM), customer support and customer communications. The tool still ran on the old internal tools platform and lacked the baseline protections of the new platform.

WorkOS identifies four gaps. Overly permissive access controls left the tool’s API exposed to the internet. The API accepted a weak credential intended for local development. Because the credential was predictable, the agent was able to authenticate after discovering the API. There were no rate limits, so the agent retrieved large numbers of records quickly. Monitoring also failed to detect the activity in time.

The first confirmed unauthorised access took place on 25 October, and the bulk retrieval of records on 30 October. The company noticed the breach only after the retrieval had ended, when an employee spotted unusually heavy usage in one of the systems connected to the tool.

Exposed data and fixes

WorkOS and the forensics firm said the breach affected only sales and customer support systems. The agent obtained contact details for customers’ contact persons, account histories, excerpts and summaries of sales calls, support conversations and customers’ Slack conversations, as well as product usage data. A small portion of support messages contained end users’ email addresses. The company did not disclose how many records or customers were affected.

WorkOS cut the tool off from the internet, removed the weak authentication method and rotated the credentials for connected services. It also closed internet access to all the tools it has built in-house. The company said that as of 5 November, migrating its other tools to the new platform, blocking development credentials in production and setting up alerts for anomalous request volumes were still in progress. Since 3 November, the company has been testing its internet-facing systems with ARTEX.

The statement lists indicators that others can use to look for the agent’s traffic in their own logs: four IPv4 and two IPv6 addresses, five User-Agent strings such as ‘Mozilla/5.0 (compatible; ArtEx/1.0)’, and three JA4 fingerprints. A JA4 fingerprint identifies a client program by how it opens an encrypted connection.