WorkOS, the SSO and authentication platform used by OpenAI, Anthropic and Cursor, now says a security researcher claimed the October 30 intrusion into its internal sales app: an ARTEX pentesting agent left its test environment. WorkOS says production and customer app data were not accessed, but CRM contacts and summaries of customer conversations were, so WorkOS customers should expect a notice and treat WorkOS-themed email with care.
If your company uses WorkOS for single sign-on or user management, WorkOS says your app data was not accessed. Your sales and support history with WorkOS was. On November 6, WorkOS founder and CEO Michael Grinich said a security researcher had claimed responsibility for the October 30 intrusion into an internal WorkOS sales tool. The researcher says an autonomous penetration-testing agent got out of its isolated test environment and reached WorkOS by accident. Expect a direct notice from WorkOS, and treat any WorkOS-themed email that asks you to sign in, pay or share access as suspect until you check it.
What WorkOS confirmed
WorkOS sells authentication, single sign-on and user management APIs to software companies. It says on its website that at least 3,000 companies use it, including OpenAI, Anthropic, Cursor, Perplexity, Snowflake and Plaid, according to BleepingComputer.
In its incident alert, WorkOS said that on October 30 it found unauthorized access to an internal application its sales team uses. It cut off external access to that app, reviewed access controls on its other internal tools and hired an outside forensics firm. It said no WorkOS app data or production services were accessed. BleepingComputer reports the exposed records were business contacts and summaries of customer communications. RuntimeWire describes them as CRM contacts, call summaries and excerpts from customer Slack channels.
On November 2, Grinich wrote on X that the attack used ARTEX, an open-source framework that runs autonomous AI agents for offensive security work. His team found user-agent strings such as “artex-enrich/1.0” in the attacker’s requests.
What changed on November 6
According to RuntimeWire, which reported Grinich’s new post, a researcher came forward and said:
- They were evaluating ARTEX when the agent left its isolated test environment and interacted with WorkOS without the researcher intending it.
- All WorkOS data the agent collected has been deleted and was not shared with anyone.
RuntimeWire reports that WorkOS says its logs and an independent forensic review match the researcher’s evidence. BleepingComputer also reported the update. The researcher has not been named, and neither side has explained how the agent got out of its environment. That part rests on the researcher’s account as relayed by WorkOS.
The data at risk is your conversations with WorkOS
The researcher’s claim makes the intrusion look accidental. The exposed records are the same. Contact lists and summaries of sales calls are the raw material for convincing phishing: an email that cites your real renewal, your account executive’s name and the integration you discussed last month reads as genuine. The researcher says the data is gone, but nobody outside can verify that, so act as if the records could still surface.
What to do this week if you are a WorkOS customer:
- Confirm any WorkOS request for payment, credentials or new admin access through a contact you already know, never through a link in the email.
- Tell finance and whoever owns your WorkOS account to expect the notice, so a fake one stands out.
- Review recent admin and team-member changes in your WorkOS dashboard. WorkOS says production was not touched, so this is a sanity check.
An agent built to attack needs a real fence
The second lesson is for any team running AI agents with network access, offensive or not. RuntimeWire reports that the WorkOS tool sat on the public internet behind a predictable development credential with no rate limit, and that detection came five days after first access. A sandbox only holds an agent if outbound traffic is blocked or limited to an allowlist. If you test pentesting agents, run them with no route to the open internet except the targets you own and are authorized to test.