Unauthorized access to WorkOS’s internal sales application has resulted in the exposure of customer contact details and business conversation records. The breach was detected on October 30, 2026, and disclosed publicly on November 2. Investigations reveal the use of an AI-driven security framework that facilitated reconnaissance and exploitation attempts.
AI Framework Involved in the Breach
According to Michael Grinich, Founder and CEO of WorkOS, the attack utilized ARTEX, an AI-powered framework capable of automating offensive security operations. This statement expands on the company’s security bulletin, which referred to an AI-assisted tool without specifying its name. ARTEX enables attackers to automate tasks like reconnaissance and exploitation efficiently.
Data Compromised in the Incident
The breached application contained sensitive information such as customer names, email addresses, phone numbers, job titles, and company affiliations sourced from CRM systems. Additionally, it included customer account history and sales relationship data. Communication records, including sales call summaries, support discussions, and Slack conversations, were also compromised.
Operational metadata, covering product usage and directory health, was accessed as well. While these categories describe the type of information available in the application, it remains unclear whether all data was accessed.
Response and Future Measures
WorkOS is conducting a thorough review of the impacted records to assess the effect on individual clients. Initial findings suggest no compromise of WorkOS application data or production services, focusing instead on CRM and customer support details. The breach highlights the increasing misuse of automated security-testing tools like ARTEX.
In response, WorkOS has disabled external access to the compromised application and is reassessing access controls across its systems. An independent digital forensics firm has been engaged to assist in the investigation, and affected customers will be contacted directly as more information becomes available.
The breach underscores the growing sophistication of automated cyber threats. Exposed customer conversation details could potentially enhance phishing attempts, making them more convincing. WorkOS advises customers to verify unexpected requests thoroughly before sharing sensitive information or taking action.
