WorkOS breach: AI pentesting suite hit sales app used by 3,000 customers

Attackers used an AI-driven offensive security framework to breach an internal WorkOS sales application on October 30, 2026, exposing business contact records and summaries of customer communications for a platform that serves at least 3,000 companies, including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, Webglow, and Netlify.

"On October 30, 2026, we identified unauthorized access to an internal WorkOS application used by our sales team," the company said in its incident alert. WorkOS builds developer infrastructure — APIs, SDKs, and tools for wiring enterprise authentication, single sign-on (SSO), user management, and identity management into applications.

According to the company's investigation, no WorkOS app data or production services were accessed or affected. The blast radius, as far as evidence shows, stops at the sales side of the house.

What data did the attacker actually reach?

The incident alert breaks the exposed material into four buckets:

• Business contact details — names, email addresses, job titles, and company affiliations pulled from CRM systems
• Customer account histories — product usage data and connection or directory health information
• Customer communications — summaries and excerpts from sales calls, support discussions, and customer Slack conversations
• Business account and relationship information — account histories plus sales and relationship context

For practitioners, that mix matters less for its sensitivity than for its usefulness in follow-on attacks. WorkOS warned users to stay alert for phishing and social engineering attempts that leverage the exposed information, and it promised to notify affected customers directly.

After detecting the intrusion, WorkOS disabled external access to the affected application and reviewed access controls on its internal tools. It also brought in an independent forensics and incident response firm to trace the unauthorized activity and pin down the full impact.

What is ARTEX AI, and why does it keep showing up?

The announcement says the attack used an AI-powered offensive security framework to automate reconnaissance and exploitation attempts. Company founder Michael Grinich got more specific: the attacker ran the ARTEX AI penetration testing suite, a tool that has surfaced in multiple incidents this year.

Chinese developers released ARTEX AI earlier this year as an open-source project for offensive security. It went private after attacks on South Korean banks, but several forks of the code remain available.

The framework's track record is worth a hard look. CrowdStrike previously revealed that the cyber-espionage group "Vapor Panda" used it in a global campaign targeting 200 organizations. The non-profit cybersecurity organization DIVD also disclosed that the same framework powered attacks it suffered last September.

Grinich explained how the investigating team made the attribution: web requests from the threat actor carried user agents including 'artex-enrich/1.0' and 'norma/0.4'. That's a fingerprint, not a guess — the kind of concrete signal IR teams can act on.

He assured customers that the incident is now fully contained, and promised more information once the investigation wraps.

Why an internal sales app is a real target

The compromise reads like a textbook progression for teams sizing their own exposure. A customer-facing identity platform stayed clean, while an internal tool holding CRM contacts, account health data, and conversation summaries gave the attacker a curated dataset for spear-phishing.

The volume of incidents tied to ARTEX AI this year — banks, a global espionage campaign across 200 organizations, a security non-profit, and now a developer platform — suggests the barrier to running automated reconnaissance and exploitation keeps dropping. Expect more disclosure detail from WorkOS once the forensic review completes, and expect security teams to start treating internal sales tooling with the same scrutiny as production.