WorkOS says an AI-powered hacking agent that breached its internal sales application and accessed customer information was operated by a security researcher who claims the tool escaped its testing environment and unintentionally attacked the company.

The developer platform disclosed the breach earlier this week, saying an attacker used the ARTEX AI offensive security framework to automate reconnaissance and exploitation attempts against its systems.

However, in a new security update published Friday, WorkOS founder Michael Grinich revealed that the person responsible had come forward and claimed the incident was accidental.

"Shortly after our original bulletin, a security researcher contacted us and claimed responsibility," Grinich said in a post on X.

"They told us they were evaluating ARTEX, an autonomous penetration testing framework, when their agent escaped its isolated testing environment and interacted with WorkOS unintentionally.”

The researcher reportedly was conducting cybersecurity benchmark evaluations using ARTEX when the agent operated outside its intended environment and began interacting with WorkOS systems.

WorkOS says its security team and an independent forensic investigator matched request details, timestamps, and other technical artifacts provided by the researcher against the company's logs, confirming with high confidence that the individual was responsible for the unauthorized activity.

The researcher also confirmed that all WorkOS data obtained by the agent had been deleted and was not shared with anyone else.

While WorkOS has confirmed the researcher's responsibility for the intrusion, the company or researcher has not publicly provided details on how the agent escaped its testing environment.

AI agent exploited weak credentials

WorkOS says the investigation also identified four security weaknesses that allowed the autonomous agent to access its internal sales application and extract customer information.

The affected application ran on a legacy internal tools platform that lacked the security protections used on the company's newer systems.

According to WorkOS, permissive access controls left the application's API endpoints exposed to the internet, allowing the agent to discover and interact with them.

The API also accepted a predictable credential intended for local development that had mistakenly been left deployed in production. This allowed the agent to authenticate after discovering the exposed endpoint.

Once authenticated, the agent abused the lack of rate limiting to rapidly retrieve records from the exposed application.

WorkOS says the first confirmed unauthorized access occurred on October 25, but the activity remained undetected until October 30, after the agent had completed downloading customer records.

The company discovered the incident when an employee noticed unusually high usage of a system connected to the affected application.

The exposed information included business contact details, customer account histories, product usage information, and summaries or excerpts from sales calls, support discussions, and customer Slack conversations.

A limited number of support communications also contained end-user email addresses.

WorkOS says its investigation, validated by an independent forensic firm, determined that the incident was limited to data stored in its sales and customer support systems.

The company noted that it had also begun regularly testing its own internet-facing systems using ARTEX on November 3, the same AI penetration-testing framework involved in the incident.

ARTEX is an AI-powered offensive security framework previously linked to cyberattacks against South Korean banks and the Dutch Institute for Vulnerability Disclosure (DIVD).

More recently, CrowdStrike reported that the Chinese cyber-espionage group Vapor Panda used the framework in a campaign targeting approximately 200 organizations.

Although the researcher claims the WorkOS incident was unintentional, the breach is another demonstration of how AI is being used to conduct autonomous attacks, even when those attacks are unintentional.

Uncover email threats your existing defenses may miss.

Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.

See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.

Start your free email security scan.