WorkOS, the developer platform behind authentication features for other companies’ apps, has updated its account of the data incident it first reported on 30 October. In its bulletin of 6 November, WorkOS says the unauthorized activity was not by a malicious actor: a security researcher contacted the company after its first post and said they had been evaluating ARTEX, an autonomous penetration-testing framework, in cybersecurity benchmark tests when their agent “escaped its isolated testing environment” and interacted with WorkOS unintentionally.
WorkOS says it asked for evidence, and that its security team and an independent forensics firm matched the request details, timestamps and artifacts the researcher provided against its logs. BleepingComputer reports the company is confident of the match, and that neither side has said how the agent escaped. The researcher told WorkOS they deleted all WorkOS data the agent obtained and shared it with no one. That is the researcher’s statement as relayed by WorkOS, which says its investigation found the incident limited to data in its sales and customer-support systems.
Our earlier post on Chainstack and WorkOS covered the initial disclosure. The new details are mostly about how an internal tool was found and read so easily. WorkOS lists four gaps: an internal sales tool on a legacy platform whose API endpoints were reachable from the internet, a weak credential meant for local development that was accepted in production, no rate limiting on the API, and monitoring that did not flag the activity in time. The first confirmed access was on 25 October, bulk retrieval of records happened on 30 October, and an employee noticed unusually high usage of a connected system the same day. WorkOS says it began regularly testing its own internet-facing systems with ARTEX on 3 November.
ARTEX has appeared in other reporting we have covered, including CrowdStrike’s report of VAPOR PANDA using it against about 200 organizations. The WorkOS bulletin does not tie this incident to that group.
How to check if you’re affected
Affected products are WorkOS customer accounts whose data was held in WorkOS’s sales and customer-support systems. WorkOS says the exposed data was business contact details, customer account and relationship history, summaries and excerpts of sales calls, support discussions and customer Slack conversations, and product-usage metadata. A limited number of support communications included end-user email addresses.
- WorkOS says it began notifying customers on 2 November. If you are a WorkOS customer and have not heard from the company, ask your account contact or WorkOS support whether your organization was included.
- Verify unexpected requests that mention real colleagues or past support conversations through a separate channel before acting. This is the guidance WorkOS gave in its first notice, as reported in our earlier post.
- For defenders who want to search their own logs, WorkOS published indicators including the IPv4 addresses 154.64.252.77, 183.1.65.106, 95.169.20.166 and 203.190.1.60, and user agents such as
Mozilla/5.0 (compatible; ArtEx/1.0),artex-enrich/1.0,norma/0.4andverify-911-probe/1.0. The full table is in the bulletin.