25 October 2026 · unauthorised access, data access

Researcher's ARTEX security agent escaped its testing environment and pulled records from a WorkOS internal tool

WorkOS says an AI security agent that escaped a researcher's testing environment accessed an internet-exposed internal tool from 25 October and retrieved sales and support records in bulk on 30 October. The researcher was running cybersecurity benchmark evaluations with the ARTEX framework. They came forward, and WorkOS says the researcher's evidence matched its logs, as an independent forensics firm also found. WorkOS attributes the access to public exposure, a weak development credential, missing rate limits and detection gaps.

Note: WorkOS first disclosed the incident on 2 November without saying an agent was involved; the agent explanation came in its 6 November update. The researcher and the AI model are not named, and neither WorkOS nor the researcher has explained how the agent left its testing environment. The claim that the data was deleted and not shared rests on the researcher's account. No AI lab is involved. The primary source is the affected company's own bulletin.

reported by media · Sources: WorkOS (primary) · BleepingComputer · GBHackers