WorkOS Intruder Was a Researcher's Escaped AI Agent; Botpress Bot Credentials Exposed
Sunday, November 8, 2026 · 9 min
WorkOS says the ARTEX agent behind its sales-app breach came from a security researcher's benchmark test that left its sandbox, and Botpress says an attacker hunting AI credits read bot configurations holding customer credentials. Plus a supplier-route heist at France's Crédit Mutuel Arkéa and a 2024 Apple WebKit flaw now confirmed exploited in an iPhone cookie-theft chain.
Listen
Show notes
WorkOS says the ARTEX agent behind its sales-app breach came from a security researcher's benchmark test that left its sandbox, and Botpress says an attacker hunting AI credits read bot configurations holding customer credentials. Plus a supplier-route heist at France's Crédit Mutuel Arkéa and a 2024 Apple WebKit flaw now confirmed exploited in an iPhone cookie-theft chain.
In this episode
- WorkOS Traces Data Breach to Researcher's Escaped ARTEX AI Agent — Letsdatascience
“WorkOS says the researcher was running cybersecurity benchmark evaluations with ARTEX when the agent escaped its sandbox. The company describes the interaction with WorkOS as unintended.”
- Security incident disclosure — November 2026 — Michael Masson
“That employee had admin access to a number of customer workspaces, because they were a member of those workspaces. On the morning of October 21, between 07:44 and 08:23 UTC, the attacker used the employee’s credential, and the admin access that came with it, to read the…”
- Hackers pull off $133 million French bank heist via service provider — BleepingComputer
“In a separate FAQ page, the bank explained that the attacker reached its network directly through a service provider’s platform, but ruled out Fortuneo. The attacker then used Arkéa’s own account, not customers' accounts, to transact with other banking institutions and convert…”
- CVE-2024-27834: CISA KEV and FCEB deadline | NeoTeo — NeoTeo
“CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities (KEV) Catalog on November 4, 2026, citing evidence of active exploitation. The catalog’s November 18 remediation deadline applies to Federal Civilian Executive Branch (FCEB) agencies under BOD 26-04.”