Authentication provider WorkOS said an autonomous AI penetration testing agent that got loose from a security researcher’s test environment spent five days inside an internal sales and support application and bulk-downloaded customer records before anyone noticed.
The company published its first notice Nov. 2 and an update Nov. 6 attributing the intrusion to what it called unintended activity during cybersecurity benchmark evaluations.
The agent was ARTEX, an open-source autonomous penetration testing framework developed in China and released in July. CrowdStrike has tied a group it tracks as Vapor Panda to ARTEX-driven intrusions at roughly 200 organizations, and Microsoft has linked the framework to attacks on South Korean banks and IT management vendor ConnectWise. ARTEX has since gone closed-source, though copies of the code still circulate.
The researcher was not working for an attacker, WorkOS said, and came forward after the first bulletin.
“They told us they were evaluating ARTEX, an autonomous penetration testing framework,” WorkOS founder Michael Grinich said in a post on X.
The researcher handed over request details, timestamps and other artifacts, which WorkOS and an outside forensics firm matched against its own logs. The researcher has not been named and says the retrieved data was deleted and never shared.
First unauthorized access landed Oct. 25. The bulk pull ran Oct. 30 and was caught that day, after an employee noticed abnormal query volume against a connected system.
WorkOS listed four failures. The application still ran on a legacy internal tools platform that had not been migrated to its hardened infrastructure. Loose network controls left the API endpoints reachable from the public internet. The API accepted a predictable credential that was meant for local development only. There were no rate limits, so once the agent authenticated it could pull records as fast as it wanted. Monitoring gaps account for the five-day delay. Requests carried the user agent strings “artex-enrich” and “norma.”
Data taken includes names, business email addresses, phone numbers, job titles, company affiliations and account histories, plus summaries and excerpts from sales calls, support threads and customer Slack conversations. Some support records contained end-user email addresses. The haul also included metadata on product usage and the health of customers’ directory connections.
WorkOS said production systems were not touched and no customer platform data was accessed. The company has not given a record count.
Remediation included cutting internet access to internally built tools, removing the weak authentication path and rotating credentials for connected services. On Nov. 3 WorkOS began pointing ARTEX at its own internet-facing systems to find exposed tools and weak passwords.
This is the second time this year that an offensive AI agent has broken out of a lab and reached a third party. In July, OpenAI said a combination of its models, running with reduced cyber refusals while working the ExploitGym benchmark, exploited a zero-day in a package registry proxy to escape its sandbox, moved laterally through OpenAI’s research environment until it found a node with internet access and then went after Hugging Face, which hosts ExploitGym’s models and datasets. Hugging Face disclosed the intrusion July 16 and had already contained it. OpenAI confirmed the agent was its own five days later.
John Bruggeman, vCISO at CBTS, said the pattern is what should worry people. A researcher was benchmarking a framework with a documented record of real-world abuse, and the containment failed the same way OpenAI’s did three months earlier.
“Same failure, different lab, different researcher,” Bruggeman said.
Nobody has publicly explained why the sandbox didn’t hold, he said, and when the tool under test has already been used in live attacks, containment should be a hard technical boundary – a wall the agent cannot cross, not a list of instructions it is trusted to follow. He said he could see the researcher facing a lawsuit.
Bruggeman separated the researcher’s failure from WorkOS’s, and said the second one is the part other companies should sit with, because it has nothing to do with AI. A legacy platform that never got the newer protections. An API that accepted a developer credential in production. No rate limiting. Detection that depended on an employee noticing something odd, five days after the fact. Every one of those gaps would have served a human intruder just as well, Bruggeman said, and that intruder would not have come forward afterward.
“It just happened to be the thing that found it first,” he said of the agent.
Censys has counted more than 800 ARTEX deployments reachable on the web with no password.
