WorkOS data breach: sales app accessed on 30 October, notice says ARTEX AI framework likely used

WorkOS, the company behind enterprise single sign-on and directory sync for many software products, has disclosed that an attacker got into an internal sales application on 30 October 2026 and read customer contact details and summaries of customer conversations. A breach notice sent to customers says the attack was "likely driven by ARTEX", the AI-assisted penetration testing framework that CrowdStrike has tied to several recent intrusion campaigns. WorkOS's public bulletin, published on 2 November, says an AI-assisted offensive security framework was used, but does not name ARTEX. The customer notice, and a comment from the company's CEO, say there is no evidence that customers' application data or production services were touched; the bulletin does not repeat that claim.

Key points

• WorkOS says it detected anomalous traffic to an internal business system on 30 October 2026 at 16:39 UTC, according to a customer notice quoted on Hacker News (WorkOS's own bulletin gives only the date).
• The accessed application served WorkOS's sales team; the data includes names, emails, phone numbers, job titles, account histories, summaries and excerpts of sales calls, support discussions and customer Slack conversations, and product usage metadata.
• The customer notice says the attack was likely run with ARTEX from IP addresses in Hong Kong and China; the public bulletin refers only to "an AI-assisted offensive security framework".
• The customer notice says there is no evidence that application data or production services were accessed; WorkOS has also disabled external access to the affected application and has hired an independent forensics firm.
• The investigation is ongoing, and WorkOS says it will contact affected customers directly.

What to do

• If you are a WorkOS customer, check your inbox (and spam) for the notice and contact security@workos.com if you want a call; that address was given by WorkOS's CEO in the Hacker News thread.
• Expect convincing phishing. WorkOS warns that contact details and details from past conversations can make fraudulent requests look real. Verify unexpected requests, especially about billing, access or credentials, through a channel you already trust.
• Check what you pasted into support threads or shared Slack channels with WorkOS. The bulletin says customer Slack conversations were among the data involved. If anyone shared an API key, a client secret or a screenshot of a dashboard there, rotate it. That is our precaution, not an instruction from WorkOS.
• API keys: neither WorkOS document, in the parts we could read, asks customers to rotate WorkOS API keys, and the customer notice says production services were not accessed. We would still follow your normal key-rotation policy if you cannot rule out that a secret was shared in a conversation.

What happened

The sequence below comes from two WorkOS documents. The first is a notice sent to customers; one customer posted it on Hacker News on 2 November, noting that it was not yet on WorkOS's website or trust centre. The second is the public bulletin, "October 30th, 2026 Data Security Incident", dated 2 November.

According to the notice, WorkOS detected anomalous traffic to an internal business system on 30 October at 16:39 UTC. The notice says the attacker reached an internal API used by the sales and marketing tools, and through it could read data from WorkOS's Salesforce and Snowflake instances. It lists business contact information, account and commercial information, aggregated and de-identified product usage metrics, marketing contacts and support tickets. It says the incident was "localized to only CRM and customer support data".

The bulletin describes the same incident in different words. It says WorkOS found unauthorised access to "an internal WorkOS application used by our sales team" and lists four data categories: business contact details, account and relationship information, "customer communications" (summaries and excerpts from sales calls, support discussions and customer Slack conversations) and operational metadata such as product usage and connection or directory health. Its response so far is to disable external access to the application, review access controls on internal tools and retain an independent digital forensics and incident response firm.

A comment on the Hacker News thread from an account called help grinich, which identified itself as the WorkOS CEO, said the production systems are secure, no customer platform data was accessed and the incident was "isolated to internal GTM systems". We have not been able to verify who wrote the comment beyond the post's own identification, so we treat it as a statement of the company's position and not as a separate source.

Where the two documents differ

The two documents agree on the main points but are not identical. The notice names ARTEX, Salesforce and Snowflake and gives a detection time; the bulletin names none of these. The bulletin is broader on the content of the data, listing call summaries and customer Slack conversations, which the notice does not mention. We cannot tell whether that is a change in what the investigation found or a difference in wording. The bulletin says the review of affected records is still going on, so the final list may change.

Background: what ARTEX is

ARTEX is an open-source multi-agent penetration testing system developed in China by a developer called Autumn-27. The Hacker News reported on 8 October, citing CrowdStrike, that a campaign from late September to early October used ARTEX against South Korean financial firms and stole data from several of them; the same report says the developer then announced it would stop updates and go closed source, saying the malicious use "violates the original purpose of the tool".

On 29 October CrowdStrike published a second report on a group it calls VAPOR PANDA. It says that from 17 October the group ran ARTEX against more than 200 organisations in at least 14 countries over 11 days, including foreign ministries, semiconductor and defence companies, and telecom providers, and that a human operator steered the agents. CrowdStrike also says that campaign is separate from ARTEX activity reported by others under the name Storm-0940. We covered it in our report on VAPOR PANDA.

That matters for reading the WorkOS news: ARTEX is available to many people, so "likely driven by ARTEX" says what tool was probably used, not who used it. Neither WorkOS document attributes the attack to a named group, and CrowdStrike's reports do not mention WorkOS.

How it connects to other incidents this week

Several developer-platform breaches have been disclosed in recent weeks, including Railway and OpenCode. Those involved customer secrets. WorkOS's case, on its own account, involved sales and support data instead. We have no evidence that the incidents are related, and none of the sources we read say they are.

What it means

For companies that rely on WorkOS for sign-in, the stated risk is indirect: someone now holds a list of WorkOS customers, their contacts and details of their conversations with the vendor. That is useful for targeted phishing, including messages that appear to come from WorkOS support or a colleague.

The bulletin's own framing is that AI agents raise "the speed and scale of attacks that exploit weaknesses such as exposed applications and stolen credentials". It does not say which weakness was exploited here, and the Hacker News thread's first questions were about the initial attack vector.

What we don't know yet

• How the attacker got in, and how the "internal API" was exposed.
• How many customers' records were read; WorkOS says it is still reviewing.
• Whether the Slack conversations and call excerpts include credentials or sensitive attachments.
• Whether ARTEX was actually used; the public bulletin says "an AI-assisted offensive security framework" and only the customer notice names it, as "likely".
• Who ran the attack.

What to watch next

WorkOS says it will provide further updates and contact affected customers directly. Watch its security bulletins page for the findings of the forensics firm, and CrowdStrike and other vendors for any link to the ARTEX activity they track.

Sources

• WorkOS: October 30th, 2026 Data Security Incident (primary source)
• Hacker News: WorkOS reports security breach (customer notice and CEO comment)
• CrowdStrike: VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign
• The Hacker News: ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms