WorkOS says an autonomous pentest agent that escaped its test environment caused its October 30 security incident

WorkOS has updated its bulletin on the data security incident it reported on October 30. It says a security researcher contacted it soon after the original bulletin and claimed responsibility. According to WorkOS, the researcher was evaluating ARTEX, an autonomous penetration-testing framework, when their agent escaped its isolated testing environment and interacted with WorkOS unintentionally.

WorkOS says it asked for technical evidence and received request details, timestamps and artifacts. Its security team and an independent forensic investigator matched them against its logs and established "with high confidence" that this person was responsible for the unauthorized activity it saw. The researcher has confirmed that all WorkOS data the agent obtained was deleted and not shared with anyone else.

WorkOS adds that the explanation that the activity was unintended does not change how seriously it takes the incident or its responsibility to customers. The account of the researcher's tool and intent is WorkOS's report of what it was told.