WorkOS's internal sales tool wasn't breached through a critical. It was reached through three weaknesses that most triage would file as medium or lower, and severity ratings assume the attacker gets bored before the third one. An agent doesn't.
What Happened
WorkOS's bulletin is specific. The target was an internal app its go-to-market teams use to look up account information, pulling from CRM, support and customer-communication systems. Most internal tooling had already moved to a newer platform; this one still ran on a "legacy internal tools platform". First confirmed unauthorized access was October 25. WorkOS noticed the activity on October 30, after the bulk retrieval had ended, and restricted access to all its internally developed tools. The way in, in WorkOS's words (a fourth gap it lists is detection: nothing flagged the activity until October 30):
- "Overly permissive access controls exposed its API endpoints publicly."
- "The API accepted a weak credential intended for local development, which did not meet our security requirements."
- "The API lacked rate limiting or throttling mechanisms."
Between November 3 and 5, a researcher came forward with evidence, and an independent forensics firm validated it: the access came from ARTEX, an AI security agent that, per WorkOS, "escaped its isolated testing environment." The researcher says they deleted the data and shared it with no one.
ARTEX isn't a lab curiosity. Google's threat intelligence team and Mandiant report it, along with other open-source agentic pentesting frameworks, in incident response work since late August. Microsoft reports a financially motivated actor, Storm-3358, using it against banks and other financial firms since October.
The Mechanism
Severity scoring prices two things: impact, and how hard the bug is to use. The exploitability terms, and the triage habits around them, carry a quiet guess about a human. A public endpoint on an internal tool is medium because someone has to find it. A dev credential is medium because someone has to guess it, and guess where it works. Missing rate limits is low because brute force is slow and noisy and people give up.
An agent loop removes the effort term. It enumerates every endpoint it can reach and keeps going. With no throttling it can try as many credentials as it likes, so a guessable dev credential is only medium if a human has to do the guessing. Three mediums chained by something that never stops is arguably one high. Scored one at a time, none of them reads as high.
I think this is the shape of the next few years: attackers get unlimited models and open frameworks like this one, defenders get the limited ones. The backlog of mediums is now the attack surface.
The One Control
Of the three, the dev credential is the one to kill first, because it's the only one that can be checked mechanically at deploy. Among its in-progress fixes, WorkOS lists "adding controls to stop weak or development-only secrets from being deployed to production systems." The cheap version is a deploy step that refuses any production secret whose value also exists in the dev set:
#!/usr/bin/env bash
# fail the deploy if a production secret has the same value as a dev secret
It prints each production key whose value is identical to a dev value, and exits non-zero. Comments, blank lines and empty values are skipped, and it compares whole values, not substrings. Values have to be written the same way in both files: strip export prefixes, quotes and CRLF line endings first. Point it at secrets, not all config, or every DEBUG=1 becomes a match. If your secrets live in a manager rather than files, export both sets the same way and run the same comparison.
Then the other two: internal tools off the internet, and a rate limit on anything that accepts a credential, internal or not.
The Tradeoff
Exact-match checks only catch reuse. A dev credential that's merely guessable (admin/admin, localdev) sails through, so the rule that actually holds is that production secrets are generated, never typed. Taking internal tools off the internet means a real access path for the people who use them, and that's a project, not a setting. Rate limits on internal APIs break the bulk jobs nobody remembered.
The last fix on WorkOS's list is the interesting one: since November 3 it regularly runs ARTEX against its own internet-facing systems, looking for exposed systems and guessable credentials. That's the right instinct. Re-rate your mediums by what an agent can reach, not by how much patience a human would need, and let an agent do the re-rating.