WorkOS Discloses Data Breach After Attacker Used ARTEX AI

Developer infrastructure provider WorkOS has reported a cybersecurity incident involving unauthorized access to an internal application used by its sales team. The threat actor gained entry to business contact records and summaries of customer communications.

• The incident was detected on October 30, 2026, targeting an internal sales application.
• The attacker leveraged the ARTEX AI offensive security framework to automate reconnaissance and exploitation.
• WorkOS application data and production services remained unaffected.
• Exposed data includes CRM business contacts, account histories, and sales call summaries.

Incident Details and Exposed Data

Following the detection of the intrusion, WorkOS disabled external access to the affected tool and reviewed internal access controls. The company also hired an independent forensics firm to investigate the scope of the unauthorized activity.

The exposed information comprises business contact details such as names, emails, job titles, and company affiliations from CRM systems. It also includes customer account histories, product usage data, and excerpts or summaries from sales calls, support discussions, and Slack conversations.

The Role of ARTEX AI

WorkOS founder Michael Grinich revealed that the attacker used the ARTEX AI penetration testing suite to automate the attack. Investigation teams identified user agent strings such as 'artex-enrich/1.0' and 'norma/0.4' within the threat actor's web requests.

The ARTEX AI framework, originally released by Chinese developers as an open-source offensive security tool, has been linked to several high-profile incidents this year, including attacks on South Korean banks and campaigns by the Vapor Panda cyber-espionage group.

Impact on Customers and Business

WorkOS provides critical developer infrastructure, including APIs and SDKs for enterprise authentication, single sign-on, and user management, serving at least 3,000 companies such as OpenAI, Anthropic, Cursor, and Netlify.

The company has promised to notify affected customers directly and warned users to remain vigilant against potential phishing and social engineering attacks leveraging the leaked details. WorkOS assured that the incident has been fully contained.