Pinned post
Latest posts 5
best way to end the week 🌅
0:26
you can’t help loving San Francisco on days like thisView quoted post on X
An update on the WorkOS security incident:
Shortly after our original bulletin, a security researcher contacted us and claimed responsibility. They told us they were evaluating ARTEX, an autonomous penetration testing framework, when their agent escaped its isolated testing environment and interacted with WorkOS unintentionally.
We asked for technical evidence. The researcher provided request details, timestamps, and artifacts from the activity. Our security team and an independent forensic investigator matched that evidence against our logs, establishing with high confidence that this individual was responsible for the unauthorized activity we observed.
The researcher has confirmed that all WorkOS data obtained by their agent has been deleted and was not shared with anyone else.
Their explanation that the activity was unintended does not change how seriously we take the incident or our responsibility to our customers.
Full report: workos.com/security/bulle…
Shortly after our original bulletin, a security researcher contacted us and claimed responsibility. They told us they were evaluating ARTEX, an autonomous penetration testing framework, when their agent escaped its isolated testing environment and interacted with WorkOS unintentionally.
We asked for technical evidence. The researcher provided request details, timestamps, and artifacts from the activity. Our security team and an independent forensic investigator matched that evidence against our logs, establishing with high confidence that this individual was responsible for the unauthorized activity we observed.
The researcher has confirmed that all WorkOS data obtained by their agent has been deleted and was not shared with anyone else.
Their explanation that the activity was unintended does not change how seriously we take the incident or our responsibility to our customers.
Full report: workos.com/security/bulle…
DX -> AX
For a long time I’ve talked about Agent Experience. Many think AX is the new DX, but that misses the bigger picture.View quoted post on X
We’re moving to an agent-first world, where agents are the primary users of all software.
AX isn’t just the new DX. It’s the new UX.
innovationendeavors.com/insights/ax-is…
Security “pre-releases” for critical vulnerabilities are becoming more common, giving many days advance notice.
How should companies prepare for this? Set a calendar reminder? Create an incident? Auto-merge the package when it drops?
Every minute will matter. The threat model has evolved. Agents move at machine speed.
The speed of your CI may be the time interval you remain vulnerable.
How should companies prepare for this? Set a calendar reminder? Create an incident? Auto-merge the package when it drops?
Every minute will matter. The threat model has evolved. Agents move at machine speed.
The speed of your CI may be the time interval you remain vulnerable.
Security release pre-alert:View quoted post on X
We will release new versions of Node.js 22, 24, and 26 release lines on or shortly, after 2026-11-11 in order to address security vulnerabilities.
The highest severity issue fixed in this release is HIGH.
nodejs.org/en/blog/vulner…
