WorkOS ties its data breach to a researcher’s AI agent; Censys finds 1,465 exposed ARTEX consoles

How it unfolded

Authentication infrastructure company WorkOS noticed a high volume of unauthorized requests to an internal tool used by its sales and customer teams on Oct. 30. It disclosed the incident on Nov. 2, saying an AI-assisted offensive security framework had been used.

According to a Nov. 6 update, the first confirmed unauthorized access took place on Oct. 25. Records were bulk-extracted on Oct. 30, and the tool was taken offline the same day. WorkOS rotated credentials and restricted access to internal tools on Oct. 30-31, and notified customers on Nov. 2. According to the company’s timeline, a researcher came forward between Nov. 3 and Nov. 5, and an independent forensics firm validated the findings.

The researcher’s account

Shortly after the first bulletin, a security researcher contacted WorkOS and claimed responsibility, according to founder Michael Grinich. Grinich wrote that the researcher was evaluating ARTEX, an autonomous penetration testing framework, when their agent “escaped its isolated testing environment.” According to the researcher, the agent interacted with WorkOS unintentionally. The WorkOS bulletin says the researcher was running cybersecurity benchmark evaluations with ARTEX at the time.

What WorkOS verified is the person’s responsibility, not the escape account. The researcher shared request details, timestamps and artifacts from the activity. The company’s security team and an independent forensic investigator matched them against its logs. Grinich said this established “with high confidence” that the individual was responsible. The researcher said all WorkOS data obtained by the agent had been deleted and not shared with anyone. Grinich wrote that the explanation does not change how seriously the company takes the incident or its responsibility to customers.

Neither WorkOS nor the researcher has explained how the agent got out of the test environment, a gap BleepingComputer also noted. The researcher’s name, affiliation and the model used have not been disclosed.

Michael Grinich@grinich

An update on the WorkOS security incident:

Shortly after our original bulletin, a security researcher contacted us and claimed responsibility. They told us they were evaluating ARTEX, an autonomous penetration testing framework, when their agent escaped its isolated testing environment and interacted with WorkOS unintentionally.

We asked for technical evidence. The researcher provided request details, timestamps, and artifacts from the activity. Our security team and an independent forensic investigator matched that evidence against our logs, establishing with high confidence that this individual was responsible for the unauthorized activity we observed.

The researcher has confirmed that all WorkOS data obtained by their agent has been deleted and was not shared with anyone else.

Their explanation that the activity was unintended does not change how seriously we take the incident or our responsibility to our customers.

Full report: workos.com/security/bulletins/update-for-october-30th-2026-data-security-incident

Four gaps and the exposed data

WorkOS’s own root cause analysis lists four gaps. First, the tool should not have been reachable from the internet, and loose access controls exposed its API endpoints. Second, the API accepted a weak, predictable credential meant for local development in production. Third, there was no rate limit, and the agent bulk-extracted records quickly on Oct. 30. Fourth, monitoring lagged. The activity was spotted only after the extraction ended, when an employee noticed unusual usage in one of the connected systems. The tool ran on a legacy internal tooling platform that had not yet been migrated.

The exposed data includes business contact details from the CRM (name, email, phone, title, company), customer account history and sales relationship information. Summaries and excerpts from sales calls, support conversations and customer Slack threads were also pulled, along with product usage data. Some support conversations contained end-user email addresses. The forensics firm confirmed that the impact was limited to sales and customer support systems. WorkOS has not said how many customers were affected. Since Nov. 3, the company has been regularly testing its own internet-facing systems with ARTEX.

Censys: 1,465 exposed ARTEX consoles

In an analysis published Nov. 5, Censys researcher Silas Cutler reported 1,465 hosts running an internet-exposed ARTEX console as of Nov. 3-4. About 650 sit in two blocks of identically configured hosting: 493 at PEG Tech (AS54600) and 157 at Yancy Limited (AS138415). That leaves roughly 815 distinct-looking deployments, according to Censys. The console does not need to be public, so Censys says the real number of installations may be higher.

The U.S. accounts for 726 of the hosts, Hong Kong for 387 and China for 177, followed by Japan (51), Singapore (38) and South Korea (21). The default port is 8787. Most consoles run the Chinese default interface, though English, Korean, Japanese, Russian and Portuguese versions also appear. On 155 hosts (10.6%), Censys also found other offensive tooling. CyberStrikeAI showed up on 70 of them, alongside Cobalt Strike, Vshell and Adaptix C2. Another 43 hosts run self-hosted LLM gateway or reseller software, and 32 open directories expose exploit kits and implants. Censys says not every ARTEX instance is run with malicious intent, and some exposed hosts likely belong to authorized testers.

Where ARTEX came from

According to Censys, a developer known as Autumn-27 published ARTEX on GitHub on July 26, 2026, under the AGPL-3.0 license. The framework is written in Go, has a Next.js web console and runs planner and worker agents. It works with Anthropic, OpenAI or OpenAI-compatible model endpoints. The developer took the project closed-source on Oct. 8, and the repository was removed. Archived copies and rebrands such as ScopeWeaver still circulate. On Oct. 7, CrowdStrike linked ARTEX to a campaign against South Korean financial institutions. On Oct. 21, Microsoft tied it to Storm-0940’s compromise of ConnectWise customers.