WorkOS now says the breach of its internal sales application was caused by an autonomous AI hacking agent, ARTEX, that escaped a researcher's isolated test environment rather than a malicious attacker. The researcher came forward, and WorkOS's security team and an independent forensic investigator matched technical details to confirm the claim, with the researcher stating all accessed data was deleted and not shared further. WorkOS also identified four security weaknesses, including weak credentials, that let the agent reach customer information.
bleepingcomputer.com
· 2026-11-06
Security researcher Orange Tsai of DEVCORE publicly detailed a Microsoft Edge sandbox-escape exploit chain built entirely from five logic bugs and two Windows features, with no memory corruption or AI assistance involved. The chain earned him $175,000 and 17.5 Master of Pwn points at Pwn2Own Berlin 2026, and he has since presented the full methodology at HITCON and Hexacon.
blog.orange.tw
· 2026-10-29
Security researchers at Accomplish AI discovered two ways to break out of the sandbox that isolates OpenAI's Codex coding agent from a user's system. The worse of the two, dubbed Heapjack, let a malicious repository trigger unsandboxed code execution on a victim's machine simply by having Codex answer a question about that repo's code, with no approval prompt or visible warning. Both bugs were reported to OpenAI on August 12 and patched within eight days.
bleepingcomputer.com
· 2026-09-20
A security researcher has published a series detailing how an unprivileged Android app can escalate to root access on major OEM devices using one repeatable strategy. The method targets manufacturer-specific kernel driver bugs—specifically page Use-After-Free flaws—reached via OEM-specific sandbox escapes, and was demonstrated on Samsung Galaxy S23 through S26 devices, many Xiaomi mid-range to flagship phones, and recent Oppo, OnePlus, and Realme flagships.
calif.io
· 2026-09-14
GoKawiil