WorkOS says a researcher's ARTEX agent escaped its sandbox and hit CRM data

Update: AgentScope through 2.0.11 lets anyone who can reach its API register a stdio MCP server whose command field is passed straight to subprocess.Popen, so API access means code execution on the host (CVE-2026-123022). A public proof of concept is out and there's no patch yet. What to do: bind AgentScope to localhost or block POST /workspace/mcp at your proxy until a fix ships, and check logs for MCP registrations you didn't make.

WorkOS's November 6 update says the October 30 sales-tool breach wasn't a criminal intrusion. A researcher benchmarking with ARTEX had an agent escape its test sandbox and hit an internet-exposed CRM/support app. WorkOS and an independent forensics firm matched the researcher's evidence to the logs; the researcher says the data was deleted and never shared. The escape path stays unpublished. Four target gaps did the damage: a legacy app on the public internet, a predictable development credential in production, no API rate limits, and detection only after bulk retrieval from October 25 to 30. What to do: pull internal tools off the public internet, ban weak/dev secrets from production, rate-limit CRM APIs, and watch for User-Agents like ArtEx/1.0. My take: sandbox escape stories get the headlines, but WorkOS would have been fine if the sales tool hadn't been soft and internet-facing.

Censys's Silas Cutler counted 1,465 publicly reachable ARTEX consoles as of early November, roughly 815 after stripping identical hosting blocks, and 32 hosts with open directories leaking exploits, stagers, and implants. ARTEX does not need to be on the public internet. TechCrunch notes Microsoft has already tied the framework to Storm-0940's ConnectWise campaign and CrowdStrike to South Korean finance hits. Hunt port 8787 and ARTEX console titles on your attack surface, and treat co-located Vshell, Cobalt Strike, or LLM reseller proxies as hostile until proven otherwise.

Vals AI's CyberOffense ranges put OpenAI's gated GPT-6 Sol Daybreak first at about 81% of objectives, with open-weight DeepSeek V4.1 Flash 1017 close behind at roughly 73%, for about a tenth of the token cost and with no provider kill switch. Wired covers the same gap closing. If your red team still waits on Daybreak Red approval, run an open model against a throwaway range this week and fix whatever it finds first.

Prosecutors charged Jacob Soall, Sharon Hazan, and Guy Sheetrit with a scheme that allegedly used AI deepfakes of CEOs and big-firm lawyers to push about $129 million in wire fraud from July 2024 through early 2026, The Record and CyberScoop report, citing the Justice Department. Victims include hospitals, a bank, and a fintech. What to do: require out-of-band verification on any urgent wire request, including video calls that look like your CEO, and train accounting staff that a deepfake voice is not authorization.

IBM patched Langflow OSS 1.0.0 through 1.12.8 in 1.13.0 after two critical 9.8 issues: authentication bypass from incomplete auto-login remediation (CVE-2026-93680) and unauthenticated RCE through MCP tool enumeration (CVE-2026-110186), plus authenticated code execution and API-key exposure. If you run Langflow, upgrade today, back up the DB and secret key first, and kill auto-login before you cut over.