WorkOS discloses data breach after attacker used ARTEX AI to breach sales app

WorkOS, a developer infrastructure company, disclosed a data breach after a threat actor used an AI offensive security framework to breach an internal application used by its sales team.

The company said in an incident alert that it identified the unauthorized access on October 30, 2026.

What happened

WorkOS said the attacker used an AI offensive security framework to automate reconnaissance and exploitation attempts.

WorkOS founder Michael Grinich said the attacker used the ARTEX AI penetration testing suite that has been observed in multiple incidents this year.

The ARTEX platform was released earlier this year by Chinese developers as an open-source project for offensive security.

Impact

Data accessed by the attacker includes business contact details, names, email addresses, job titles, and company affiliations from the CRM systems.

The attacker also reached customer account histories covering product usage and connection or directory health, as well as summaries and excerpts from sales calls, support discussions, and customer Slack conversations.

Based on evidence from the investigation, no WorkOS app data or production services were accessed or affected.

At least 3,000 companies use WorkOS's services, including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, Webglow, and Netlify.

Response

After detecting the intrusion, WorkOS disabled external access to the affected application and reviewed its access controls on internal tools.

The company contracted an independent forensics and incident response firm to track the unauthorized activity and determine its full impact.

WorkOS promised to notify affected customers directly and warned its users to remain vigilant for phishing or social engineering attempts leveraging the exposed information.

Grinich said investigators identified user agents such as artex-enrich/1.0 and norma/0.4 in web requests from the threat actor.

The founder said the incident has now been fully contained and promised to share more information after the investigation completes.

Lessons for security leaders

Sales and CRM applications often hold the same kind of sensitive customer detail and conversation history that attackers can weaponize for convincing follow-on phishing, so they deserve access reviews and monitoring comparable to production systems. Security teams should watch for the distinctive traffic patterns of automated AI pentesting frameworks, such as unusual volumes of reconnaissance requests or unfamiliar automated user agents, rather than assuming attack speed will stay at human pace. Incident plans should already specify when to bring in outside forensics help and how to notify affected customers quickly, since the information exposed in internal sales tools can be used to craft targeted social engineering against those same customers.