James Wilson
Technology editor at Risky Business Media and self-described reformed CTO who covers cybersecurity through an enterprise lens.
“This wasn't some zero day. This wasn't even some end day in some other product. It's not supply chain. What this was in WorkOS's case was an old service running on a platform that they knew was legacy, that they knew did not have the right controls. … This is just your classic long tail. … We used to get comfortable with that long tail for various factors, not least of which no one's going to really go after that thing. … And that's what's changed here.”
Risky Business · Software Engineering & Infra · November 2026
Context
The hosts were discussing a WorkOS incident where an attacker reportedly used the ARTEX AI pentesting framework against an internal app. James says the breach was not a clever exploit but a neglected legacy service, and that agents make it cheap to attack old systems nobody bothered to defend.
Transcript
…to have to bring the, you know, the two teams together on cyber and anti-fraud back together. So it's, it's, uh, and that's just right now. I mean, what happens a month from now when it's the next framework? Because they're going to keep getting better and there are going to be more of them. So
…I mean, I think it is. I know I sound a little hysterical here, but I think there's a lot of chickens coming home to roost. I think that for too long, people really have relied on the fact that there aren't enough man hours in the underground to go and exploit everything. And AI changes that.
But this is exactly what happened in the case of WorkOS. And this resonates with me so much from some of the roles I've been in in the past. This wasn't some zero day. This wasn't even some end day in some other product. It's not supply chain. What this was in WorkOS's case was an old service running on a platform that they knew was legacy that they knew did not have the right controls, but no one came to work one day and said, let's deploy that thing on that old system. This is just your classic long tail. This would have been on someone's register. This would have been on someone's plan. This would have been on some roadmap to get resolved at some point in the future. But we used to get comfortable with that long tail for various factors, not least of which no one's going to really go after that thing or there's just juice isn't worth the squeeze. And that's what's changed here.
Well, okay. Okay. So there's been a lot of debate about, well, okay, who cares that LLMs are finding ODA? ODA is not really how people get hacked anyway. And why are people so alarmed? A couple of like think fluent. In the security space, including a convicted felon who could I'd be talking about…
Yeah, I completely agree. I think the importance and excitement that we naturally attribute to the latest and greatest CVE and Zero Day and all the rest, that just doesn't matter to an agent. It cares most about path of least resistance, least effort, and just keep trying and trying and trying. So…
Yeah, Chris, you had something to add there.
More from Risky Business
