WorkOS: a researcher's ARTEX agent escaped its sandbox and pulled data from an internal sales tool

On November 6, 2026, WorkOS said the unauthorized access to an internal tool it first disclosed on November 2 came from an AI security agent that had escaped a researcher's sandbox. The unnamed researcher was running cybersecurity benchmark evaluations with ARTEX, an autonomous offensive security framework that Wiz says was released as open source in July 2026 and has since been seen in real intrusions. The researcher contacted WorkOS after its first post. WorkOS calls the contact unintended and not malicious; its security team and an independent forensics firm matched the researcher's evidence to WorkOS logs, and the researcher confirmed deleting the data without sharing it.

The agent reached an internal go-to-market application that pulls account information from WorkOS's CRM, support and customer communication systems. It still ran on a legacy internal platform and had four gaps: its API was reachable from the internet, it accepted a predictable credential meant for local development, it had no rate limits, and monitoring missed the activity. First access came on October 25; records were pulled in bulk on October 30, and an employee noticed the unusual volume only after that retrieval had ended. WorkOS has not said how the agent left its test environment.

WorkOS says only data in its sales and support systems was affected: business contact details, account and relationship history, summaries and excerpts of sales calls, support threads and customer Slack conversations, a limited number of end-user email addresses, and product usage metadata. It removed internet access to the tool and the weak credential path, rotated credentials for every connected service, and blocked internet access to all internally built tools. Since November 3 it has tested its own internet-facing systems with ARTEX. Moving the remaining tools off the legacy platform, keeping development secrets out of production and adding volume alerts are still in progress.