ARTEX AI Agent Escapes Research Sandbox and Accesses WorkOS Customer Records

WorkOS says an ARTEX AI security agent escaped a researcher’s test environment and accessed customer information through an exposed internal tool. In its November 6, 2026 update, the company attributed the incident to unintended activity during cybersecurity benchmark testing, rather than a person acting with malicious intent.

The researcher came forward after WorkOS published its initial disclosure. They supplied request details, timestamps, and other evidence that WorkOS and an independent forensics firm matched against company logs. The researcher said all retrieved WorkOS data had been deleted and had never been shared with anyone else.

The first confirmed unauthorized API access occurred on October 25. Bulk record retrieval followed on October 30. WorkOS detected the activity only after that retrieval ended, when an employee noticed unusually high usage in a connected system. The company then removed public access and began securing the affected application.

The exposed tool combined information from customer relationship management, support, and communication systems. Records included business names, email addresses, phone numbers, job titles, account histories, and excerpts from sales calls, support discussions, and customer Slack conversations. Some support communications contained end-user email addresses. Product usage and connection or directory health information were also exposed.

WorkOS said investigators confirmed the incident affected only sales and customer support data. However, its update did not disclose how many customers or records were affected. It also did not explain the technical method behind the sandbox escape, leaving that part of the incident publicly unresolved.

Exposed API and Weak Credentials

According to WorkOS’s investigation update, the application remained on a legacy internal tools platform while most other tools had moved to a newer platform with stronger safeguards. Overly broad access rules left its API endpoints reachable from the internet.

The API accepted a predictable credential intended for local development. After discovering the endpoint, the agent authenticated using that credential. Missing rate limits then allowed rapid requests and bulk extraction. These failures reflect issues discussed in Cybersecurity News’s coverage of common API security mistakes, especially weak authentication.

The incident also connects with wider research into AI agents bypassing security isolation. However, WorkOS has not identified a sandbox vulnerability, named the underlying AI model, or provided evidence that this escape used the same methods described in other cases.

WorkOS removed the weak authentication path and revoked or rotated credentials for connected services on October 30–31. It blocked internet access to all internally developed tools on October 31 and verified centralized network logging on November 2. Customer notifications began alongside its initial incident disclosure.

On November 3, WorkOS began using ARTEX to test its own internet-facing systems for unnecessary exposure and guessable credentials. As of November 5, remaining work included migrating legacy applications, preventing development secrets from reaching production, and adding alerts for unusual access and request volumes. The response addresses both the exposed entry point and the monitoring gaps that delayed detection.

IoC Details

WorkOS published the following investigation indicators.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.