WorkOS has found out who broke into its internal sales tool, and it was not a criminal crew. A researcher who was benchmarking an AI hacking framework contacted the company after its first disclosure and said their agent had wandered out of its test environment and hit WorkOS by mistake.
The company’s own findings are harsher on itself than on the researcher. The agent got in through an API that was open to the internet, logged in with a predictable password that was meant for local development, and then downloaded records at speed because nothing limited how fast it could ask. Nobody noticed for five days.
The tool is the lookup page WorkOS staff use for customer accounts, built on top of its CRM, support desk and customer chat systems. What leaked is the stuff a sales team keeps on customers: who they are and how to reach them, how long they have been clients, how they use the product, and snippets from calls, support tickets and shared Slack channels. A small number of support messages carried email addresses belonging to customers’ own users. WorkOS says an outside forensics firm confirmed nothing else was reached. The 3 November report on the breach was written before the researcher came forward.
The timeline is short. The agent first reached the API on 25 October. On 30 October it pulled records in bulk, and WorkOS only reacted afterwards, when an employee spotted heavy traffic in a system connected to the tool. Public access was shut that day, credentials for connected services were replaced by 31 October, and customer notices went out on 2 November.
The researcher backed the claim with their own request logs, and WorkOS says those line up with its records. According to the researcher, all of the data was wiped and never passed on. That statement rests on the researcher’s word. Still unanswered: how the agent got out of its sandbox, which AI model drove it, and how many customers were in the tool.
WorkOS gives four reasons the incident was possible: the tool lived on an old internal platform without newer protections, it faced the public internet, it accepted the development password in production, and monitoring was too slow. To fix that, it is moving the remaining legacy tools to the newer platform, stopping dev-only secrets from being deployed live, and setting up alerts for odd access and traffic spikes. Oddly, the company now uses the same ARTEX tool as a scanner on its own public servers, a routine it began on 3 November, hunting for forgotten services and easy passwords.
WorkOS asks anyone who finds a flaw to report it to [email protected], and its bulletin lists the technical indicators from the investigation.
