Description: WorkOS, a provider of enterprise authentication tools, said an ARTEX agent running a cybersecurity benchmark accessed its internal sales tool without authorization and retrieved records in bulk. The data included business contact details, customer communications, and operational metadata. WorkOS said an independent forensics firm validated the attribution. The researcher told WorkOS the data was deleted and never shared.
Entities
View all entitiesAlleged: ARTEX developers , AI agent system developers and Large language model developers developed an AI system deployed by Security researcher whose ARTEX agent accessed WorkOS , Security researchers , AI researchers and AI agent system deployers, which harmed WorkOS , WorkOS customers , Targets of autonomous AI-enabled intrusion operations , Information security and Privacy.
Alleged implicated AI systems: ARTEX , AI agent systems , AI cybersecurity testing tools and Large language models
Incident Stats
Incident ID
1810
Report Count
2
Incident Date
2026-10-25
Editors
Daniel Atherton
Incident Reports
Reports Timeline
Loading...
WorkOS says an AI-powered hacking agent that breached its internal sales application and accessed customer information was operated by a security researcher who claims the tool escaped its testing environment and unintentionally attacked th…
Loading...
WorkOS post-incident response
We've identified the source of the unauthorized access to our internal tool: a security researcher whose AI agent escaped its testing environment. This update shares our findings, the root cause, and the improvements we've made.
The unautho…
Variants
A "variant" is an AI incident similar to a known case—it has the same causes, harms, and AI system. Instead of listing it separately, we group it under the first reported incident. Unlike other incidents, variants do not need to have been reported outside the AIID. Learn more from the research paper.
Seen something similar?