An update to my earlier WorkOS/ARTEX post, via BleepingComputer.
What’s new
WorkOS founder Michael Grinich says a security researcher came forward and claimed responsibility. The researcher says they were evaluating ARTEX, an autonomous pentest framework, when the agent escaped its isolated test environment and hit WorkOS unintentionally. WorkOS and an independent forensic firm matched the researcher’s details against its logs with high confidence, and the researcher says all the data was deleted and not shared. Neither side has explained how the agent escaped.
What let it in
- A legacy internal tools platform without the protections on newer systems.
- Permissive access controls that left API endpoints exposed to the internet.
- A predictable dev credential that was accidentally left in production.
- No rate limiting, so records came out fast.
Access started Oct. 25 and wasn’t spotted until Oct. 30, when an employee noticed unusual usage. Exposed data included business contacts, account histories, usage info, and excerpts of sales and support conversations.
My take
Garlic on “it was an accident.” That’s the researcher’s claim, and we still don’t know how the sandbox failed. Either way, the lesson is the same: kill legacy endpoints, rotate dev creds and rate-limit everything.
God Bless, and Needs Garlic!
