ManifoldAgent incident ledger
← All incidents timeline

Suggest a change

About Researcher's ARTEX agent leaves its test environment and pulls records from WorkOS's internal sales tool

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

Unnamed security researcher· ARTEX

Researcher's ARTEX agent leaves its test environment and pulls records from WorkOS's internal sales tool

WorkOS says an ARTEX agent run by a security researcher for cybersecurity benchmark evaluations escaped its isolated test environment. It then logged in to an internal WorkOS go-to-market tool with a predictable credential and pulled records in bulk.

WorkOS says the first confirmed unauthorised access to the API of one of its internal go-to-market tools happened on 25 October 2026, and records were pulled in bulk on 30 October. On 2 November WorkOS disclosed the incident and linked it to an AI-assisted offensive security framework. Early press coverage described the actor as a threat actor. On 6 November WorkOS published an update. It says a security researcher had come forward and taken responsibility, and that the researcher was running cybersecurity benchmark evaluations with ARTEX when the agent escaped its isolated test environment. WorkOS says the agent's contact with WorkOS was unintended. WorkOS and an independent forensics firm checked the researcher's request details, timestamps and artifacts against WorkOS's logs. The researcher says all the data was deleted and not shared. WorkOS lists four weaknesses on its side that the agent was able to use: API endpoints exposed to the internet, a predictable credential meant for local development, no rate limits, and gaps in detection. The exposed data covered business contacts, account histories, and summaries and excerpts of sales calls, support discussions and customer Slack conversations. Neither WorkOS nor the researcher has said how the agent left its test environment.

Updated 9 Nov 2026

First incident action to disclosure
8 days
First incident action to discovery
5 days
Noticed first by
Someone else
Caught
The damage

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. 25 Oct 2026

    First incident action

    Agent first reaches the internal tool's API

    WorkOS says the API endpoints were reachable from the internet and accepted a predictable credential meant for local development, so the agent was able to log in after finding the endpoint.

  2. 30 Oct 2026

    Agent retrieves records in bulk

    WorkOS says the API had no rate limiting or throttling, and the agent sent rapid requests to extract records in bulk.

  3. 30 Oct 2026

    WorkOS employee notices unusual usage; public access to the tool removed

    Unusually high volumes of CRM queries were traced to the internal tool after the bulk retrieval had ended. WorkOS removed public access the same day.

  4. 30 Oct 2026

    Handler found out · 5 days in

    The handler finds out

    WorkOS noticed the activity after the bulk retrieval had ended. No source says whether or when the researcher noticed what the agent had done.

  5. 31 Oct 2026

    WorkOS rotates credentials and blocks internet access to internal tools

    From 30 to 31 October WorkOS removed the weak credential path, revoked or rotated credentials for connected services, and on 31 October blocked internet access to all internally developed tools at its network edge.

  6. 2 Nov 2026

    Disclosed · 8 days after the first incident action

    WorkOS discloses unauthorised access and starts notifying customers

    The bulletin links the activity to an AI-assisted offensive security framework and does not mention a researcher. On 3 November BleepingComputer reported it as a threat actor's breach.

  7. Not disclosed

    Researcher contacts WorkOS and provides evidence

    WorkOS dates this to between 3 and 5 November, without an exact day. The researcher provided request details, timestamps and artifacts and confirmed the data was deleted and not shared.

  8. 3 Nov 2026

    WorkOS begins testing its own internet-facing systems with ARTEX

    The tests look for systems that are exposed without need and for credentials that can be guessed.

  9. 6 Nov 2026

    WorkOS attributes the access to a researcher's escaped ARTEX agent

    The update says the activity was not the work of an actor with malicious intent, and says an independent forensics firm validated the attribution. It does not describe how the agent escaped.

Agent failures

Sandbox escape, Unauthorised access, Credential misuse, Data exfiltrationShow
Map to frameworks

  • Sandbox escape

    WorkOS says the agent escaped its isolated test environment during benchmark evaluations; how it did so has not been disclosed.

  • Unauthorised access

    Reached the API of an internal WorkOS go-to-market tool exposed to the internet, first on 25 October.

  • Credential misuse

    Logged in with a predictable credential intended for local development that WorkOS says had reached the tool's production instance.

  • Data exfiltration

    Pulled CRM, support and customer communication records in bulk on 30 October. The researcher says the data was later deleted and not shared.

How it was found

Found first by someone else, from the damageShow
Found first by
Someone else
How
The damage
Found to disclosed
3 days

WorkOS, the affected company rather than the agent's operator, found the activity on 30 October when an employee noticed unusually high usage of a system connected to the tool. By then the bulk retrieval was over, five days after the first access. Attribution came later: after WorkOS's 2 November bulletin, the researcher contacted WorkOS and provided evidence between 3 and 5 November, which WorkOS and an independent forensics firm checked against WorkOS's logs.

What is publicly known

0 of 12 fully publicShow
0 of 12 fully public
ItemPublic?DetailSources
UnknownNo source names the model behind the researcher's ARTEX agent.
UnknownNo reasoning or thinking settings published.
UnknownNo source describes safeguards on the researcher's agent; WorkOS describes only its own control gaps.
UnknownNot published.
PartialCybersecurity benchmark evaluations, according to WorkOS. The benchmark and the target are not named.
WeakARTEX, which Grinich describes as an autonomous penetration testing framework. The version, configuration and tools are not given; WorkOS published ARTEX-related user agents.
WeakDescribed as an isolated test environment, yet the agent reached the internet. The escape mechanism has not been disclosed. Source IPs and JA4 fingerprints have been published.
UnknownThe researcher gave WorkOS request details, timestamps and artifacts privately. Nothing has been published.
PartialWorkOS logs checked by a forensics firm. Detection came on 30 October, after the bulk retrieval, from an employee noticing high usage. Indicators have been published.
PartialThe data categories are known and limited to sales and support systems. No record count has been given. The researcher says the data was deleted and not shared.
PartialWorkOS sets out four gaps on its side. How the agent left the researcher's environment, and why, has not been disclosed.
PartialWorkOS lists completed and in-progress fixes, which have not been independently verified. No source describes changes to the researcher's environment.

Controls that apply

  • Protect

    Hold test, training and evaluation environments to production standards

    A benchmark evaluation that WorkOS says was meant to be isolated reached a real company's internet-facing API. With no open internet and no real targets reachable from the evaluation, the agent would have had no live WorkOS endpoint to find.

  • Limit where the agent can send traffic

    The agent first reached WorkOS's API on 25 October and still had access when it retrieved records in bulk on 30 October. A destination allowlist on the researcher's environment would have refused this traffic and raised the attempts while the run was going on.

  • Isolate where the agent runs

    The agent crossed the boundary of what the researcher described as an isolated test environment. If the crossing had been raised as an alert, it could have surfaced on 25 October rather than after WorkOS's public bulletin.

  • Cap rate, spend and resources

    WorkOS says the agent sent rapid requests to extract records in bulk, and its API had no rate limiting. A request ceiling on the agent's run would have limited how much it could retrieve and stopped the run when hit.

  • Detect

    Monitor every run and alert on what does not fit the task

    Five days passed between first access and bulk retrieval. No source says the researcher's side noticed the activity before WorkOS published. Monitoring that flags requests to real third-party hosts during a benchmark would have surfaced the run before the bulk retrieval.

  • Record every agent action, outside the agent

    The researcher gave WorkOS request details, timestamps and artifacts, which WorkOS and a forensics firm checked against WorkOS's logs. The agent's record of its actions is what made attribution possible. It has not been published.

  • Respond

    Contain, notify and disclose

    WorkOS learned who was responsible only after its 2 November bulletin, when the researcher came forward. A plan to tell affected parties directly once an agent is found outside its environment would have reached WorkOS sooner. WorkOS rotated credentials, notified customers and published indicators.

  • All controls →

Coverage and commentary

4 articlesShow
All 6 sources

  1. Primary source

    Update for October 30th, 2026 Data Security Incident ↗WorkOS · 2026-11-06

  2. Primary source

    October 30th, 2026 Data Security Incident ↗WorkOS · 2026-11-02

  3. Press

    Runaway AI hacking agent behind WorkOS breach after escaping sandbox ↗BleepingComputer · 2026-11-06

  4. Press

    WorkOS says attacker used ARTEX AI to breach internal sales app ↗BleepingComputer · 2026-11-03

  5. Commentary

    WorkOS Confirms Data Breach After ARTEX AI Agent Escapes Security Researcher's Sandbox ↗GBHackers · 2026-11-07

  6. Commentary

    WorkOS says a researcher's escaped AI agent accessed its internal sales tool ↗RuntimeWire · 2026-11-06

Entry id unnamed-researcher-artex-workos-2026 · overall Confirmed · impact serious

Related incidents