WorkOS says the AI-powered hacking agent that infiltrated its internal sales applications and accessed customer information was operated by security researchers. According to the company, the agent escaped its isolated test environment while researchers were evaluating the ARTEX offensive security framework and inadvertently attacked WorkOS.
The developer platform disclosed the incident earlier this week, reporting that the attackers used ARTEX to automate reconnaissance and exploitation attempts against its systems. In a new security update, WorkOS founder Michael Grinich said the person responsible had come forward and claimed the incident was accidental.
“Shortly after the initial bulletin, a security researcher contacted us and claimed responsibility,” Grinich said in a post on X.
“They told us that while they were evaluating ARTEX, an autonomous penetration testing framework, an agent escaped from their isolated testing environment and inadvertently interacted with WorkOS.”
According to WorkOS, the researchers were conducting a cybersecurity benchmark evaluation when the agent began operating outside its intended environment and interacting with the company’s systems.
WorkOS said its security team and independent forensic investigators compared the request details, timestamps and other technical artifacts supplied by the researcher with company logs. The investigation confirmed with a high degree of confidence that the individual was responsible for the unauthorized activity.
The researchers also said that all WorkOS data captured by the agent was deleted and was not shared with anyone else.
Although WorkOS confirmed the researchers’ responsibility for the intrusion, neither the company nor the researchers disclosed how the agent escaped the test environment.
AI agent exploited weak credentials
WorkOS said its investigation identified four security vulnerabilities that could allow autonomous agents to access internal sales applications and extract customer information.
The affected applications ran on a legacy internal tooling platform that did not have the security protections implemented in the company’s newer systems.
Permissive access controls left the applications’ API endpoints exposed to the internet, allowing agents to discover and interact with them. The API also accepted predictable credentials intended for local development, which had accidentally been left deployed in production.
After discovering an exposed endpoint, the agent could use those credentials to authenticate. It then exploited the lack of rate limiting to rapidly retrieve records from the application.
WorkOS said the first known unauthorized access occurred on October 25. The activity was not detected until October 30, when the agents had completed downloading customer records.
Employees discovered the incident after noticing unusually high usage on systems connected to the affected applications.
The exposed information included business contact details, customer account history, product usage information, sales calls, support discussions, and summaries and excerpts of Slack conversations with customers. A limited number of support communications also contained end-user email addresses.
WorkOS said an investigation reviewed by an independent forensic firm determined that the incident was limited to data stored in its sales and customer support systems.
WorkOS begins ARTEX testing
On November 3, WorkOS said it began regularly testing its internet-connected systems with ARTEX, the same AI penetration testing framework involved in the incident.
ARTEX is an AI-powered offensive security framework previously linked to cyberattacks against a South Korean bank and the Dutch Vulnerability Disclosure Institute (DIVD).
CrowdStrike recently reported that the Chinese cyber-espionage group Vapor Panda used the framework in a campaign targeting approximately 200 organizations.
Although the researchers maintain that the WorkOS incident was unintentional, the breach demonstrates how AI systems can carry out autonomous attacks, including in situations where the operators did not intend to target the victim.
Source: www.bleepingcomputer.com