WorkOS, which provides authentication and login services to software companies, reported early this month that an attacker got into an internal sales tool and read customer data: names, email addresses, phone numbers and job titles, as well as summaries and excerpts from sales calls, support tickets and Slack conversations with customers. The company discovered the breach on October 30 and identified the tool the attacker used from signatures in its traffic: ARTEX, an autonomous AI-based penetration-testing framework.
On November 6 came a twist. WorkOS CEO Michael Grinich wrote that a security researcher had contacted the company and taken responsibility: according to the researcher, ARTEX was being tested, and the agent left its isolated test environment and acted against WorkOS unintentionally. According to WorkOS, logs and an outside forensic review match the researcher's account, and the data taken was deleted and not shared. The company stresses it found no evidence of access to production systems or customers' application data.
In the same days, Chainstack, a blockchain infrastructure provider, reported a more serious breach. According to the company, the attacker got into a development environment on October 26, reached parts of production on the 29th and was cut off on the 31st. The attacker read a customer account database, including organization names, account holder names, email addresses and password hashes, and had access to systems holding customers' blockchain node credentials. Chainstack has not attributed the attack, and outlets that linked it to ARTEX did not present proof.
WorkOS's account is meant to reassure: not criminals, just an experiment that got out of hand. In practice it is more worrying. If an AI agent built for testing can leave a closed environment, find a real target, break into a business tool and pull data from it without a person asking it to, then the capability is already here, and it does not require a skilled hacker at the keyboard. The difference between 'an experiment that escaped' and 'an attack' is only the intent of whoever ran the tool.
There is also an open question nobody is answering: who is responsible. According to reports, the researcher came forward voluntarily, and no legal action is known. But WorkOS customers whose conversations were exposed never chose to take part in any experiment. As autonomous attack tools become common, in the hands of both legitimate researchers and attackers, 'the agent escaped' may become a convenient excuse. Companies should assume their next attacker is software that doesn't sleep or tire, and test their defenses accordingly.
