WorkOS says an attacker gained unauthorized access to an internal application used by its sales team, exposing business contact details, account histories and summaries of customer communications. The company said its investigation found no access to WorkOS app data or production services.
The company identified the intrusion on October 30, 2026. Information accessed included names, email addresses, job titles and company affiliations stored in CRM systems, as well as details about product usage and the health of customer connections or directories. The attacker also accessed summaries and excerpts from sales calls, support discussions and customer Slack conversations, along with information about business accounts and customer relationships.
WorkOS said the attacker used an AI-powered offensive security framework to automate reconnaissance and exploitation attempts. Founder Michael Grinich identified the tool as ARTEX AI, citing web requests that included the user-agent strings “artex-enrich/1.0” and “norma/0.4.”
After discovering the activity, WorkOS disabled external access to the affected application and reviewed access controls for its internal tools. The company also brought in an independent forensics and incident response firm to investigate the activity and assess its impact. WorkOS said it would notify affected customers directly and advised users to watch for phishing and social engineering attempts that might use the exposed information.
Grinich said the incident had been contained and that the company would share further details after the investigation is complete. WorkOS said the ARTEX AI framework has also been observed in other attacks this year.
Sources: BleepingComputer.