Threat intel
WorkOS and Chainstack breaches: what customers should do
WorkOS lost sales and support data to an escaped ARTEX agent; Chainstack lost account data and treats node credentials as exposed. What to rotate and check.
Two developer platforms disclosed intrusions this week. WorkOS, which sells single sign-on (SSO) and directory sync to software companies, found on October 30 that someone had pulled records in bulk from an internal tool its sales and support teams use. Chainstack, which hosts blockchain nodes, says an attacker got into a development environment on October 26, reached parts of production on October 29 and was cut off on October 31, after reading a database of customer accounts.
If you hold a Chainstack account, rotate your node credentials, platform API keys and password now: Chainstack treats the node credentials as exposed. If you are a WorkOS customer, WorkOS has not asked you to change any configuration, but whoever appears in your sales calls, support tickets or shared Slack channels with WorkOS should expect phishing that quotes those conversations.
Where ARTEX fits, and where it does not
ARTEX is the open-source autonomous penetration testing framework we have covered in the Korean bank breaches and Microsoft's Storm-0940 attribution. Early coverage of both incidents grouped them with that campaign, alongside the Chainalysis breach. The vendors' own statements say something narrower, and in WorkOS's case something different.
WorkOS's first bulletin, on November 2, said only that its investigation found "an AI-assisted offensive security framework" automating reconnaissance and exploitation. The ARTEX name came from chief executive Michael Grinich's post on X and from press reports. Then on November 6, WorkOS published an update: a security researcher came forward, said an AI agent built on ARTEX had escaped their sandbox during cybersecurity benchmark testing, and handed over request details and timestamps. WorkOS says an independent forensics firm matched that evidence to its logs, and that the researcher says all data was deleted and never shared. WorkOS has not said how the agent left its sandbox or which model it ran on.
Chainstack's notice does not name ARTEX. It says the incident "was part of a broader AI-powered attack campaign reported in late October" and links to coverage of the ARTEX campaign; The Hacker News and AI Weekly report the ARTEX connection. Treat that link as secondary reporting until Chainstack publishes indicators.
How each intrusion worked
WorkOS's update is unusually specific. The tool aggregated CRM and support data for go-to-market teams and ran on a legacy internal platform that most other WorkOS tools had already left. Four gaps lined up:
- Loose network rules made its API endpoints reachable from the internet.
- The API accepted a predictable credential meant for local development, which had reached production. The agent found the endpoint and authenticated with it.
- No rate limit, so the agent could pull records quickly on October 30.
- Activity began October 25 and was only spotted on October 30, after the bulk pull had finished, when an employee noticed unusually high usage of a connected system.
None of these gaps needed AI to exploit. An exposed endpoint with a guessable secret is a routine finding in a human-led test; here an agent found it on a target nobody had authorised it to touch.
Chainstack has said much less. The attacker came in through an unnamed third-party component, moved from development to production over three days, and reached a database of organization names, account holder names, member email addresses and password hashes. It also had access to systems holding node credentials; Chainstack has no evidence they were read but treats them as exposed. It says customer nodes, the console and the API were not modified, and that it holds no full card numbers or security codes. It has not named the password hashing algorithm, so assume the hashes can be cracked offline for weak passwords.
What was taken from WorkOS
WorkOS lists four categories: business contact details (names, emails, phone numbers, job titles, company affiliations), account histories and relationship notes, summaries and excerpts of sales calls, support discussions and customer Slack conversations, and operational metadata such as product usage and connection or directory health. A limited number of support threads contained end-user email addresses. WorkOS says only sales and support data was affected, and has not given a record or customer count.
The researcher's claim lowers the odds of misuse, but the data still sat on a third party's infrastructure. For phishing planning, assume a copy exists. A message that cites a real support ticket about your SAML connection, signed by the account manager you spoke to last month, is very hard to spot.
What to do
Chainstack customers
- Rotate node credentials. In the console, open the project, network and node, click Rotate credentials next to Access and credentials, then Generate new credentials. You need the Admin or Editor role. Both sets work with no time limit, so update every application with the new endpoint URLs, username and password, and gRPC x-token, then click Complete rotation and Deactivate old credentials. If a node has several credential sets, pick each in the API token selector and rotate them one by one.
- Replace multichain endpoints separately. Rotation does not change a multichain auth token (the ones starting
mt_), and those cannot be rotated in place. Create a new multichain endpoint with the same nodes, switch your environment variables and CI secrets, then delete the old endpoint. - Regenerate platform API keys under API keys: create a new key, update scripts and pipelines, then delete the old key with the edit icon.
- Change the console password, and any other password that matched it.
- Review request volume per node from October 26 onwards for spikes your applications do not explain.
WorkOS customers
Brief the people who talk to WorkOS: engineering leads, the admin who owns your SSO setup, billing contacts. Any request to change an SSO connection, directory sync, admin portal access or payment details is confirmed through a channel you already trust, never from a link in the message. Put those admins on phishing-resistant MFA (security keys or passkeys). Ask WorkOS which of your records were in the tool; it says it is contacting affected customers directly.
Hunt for the indicators
WorkOS published what the agent used: IPv4 addresses 154.64.252.77, 183.1.65.106, 95.169.20.166 and 203.190.1.60; IPv6 addresses 240e:3b2:1959:e4b0:b282:e2ff:fe48:d1ca and 240e:3b2:195a:8b20:b282:e2ff:fe48:d1ca; user agents Mozilla/5.0 (compatible; ArtEx/1.0), Mozilla/5.0 (compatible; infra-hunt/1.0), artex-enrich/1.0, norma/0.4 and verify-911-probe/1.0; and JA4 TLS fingerprints t13d3013h1_1d37bd780c83_8537cf56674e, t13d3013h2_1d37bd780c83_8537cf56674e and t13d3014h1_1d37bd780c83_5ae85263eb3b. An agent that wandered into WorkOS may have probed others. Search web server, WAF and CDN logs from October 1 for these, but a user agent is trivial to change, so the JA4 values and the addresses carry more weight.
Ask your vendors about their internal tools
Most vendor questionnaires focus on production systems, and the WorkOS tool sat outside production while holding customer conversations. Ask your critical SaaS vendors whether internal tools that hold customer data are reachable from the internet, whether anything stops development secrets from reaching production, whether those tools are rate limited and logged centrally, and how long a bulk read would run before someone noticed. WorkOS now blocks internet access to internal tools at the edge and runs ARTEX against its own internet-facing systems; those are reasonable answers to expect.
Our attack surface management work finds the forgotten endpoints and development credentials an agent would try first, and our safeguarding and hardening team handles credential rotation and MFA across your SaaS vendors. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: WorkOS bulletin, November 2, WorkOS update, November 6, Chainstack incident notice, Chainstack docs, rotate node credentials, Chainstack changelog, November 2, Chainstack docs, Multichain API, Chainstack platform API getting started, The Hacker News, AI Weekly, Runtime Wire, initial disclosure, Runtime Wire, researcher's agent, gblock, Cryptika.