WorkOS has disclosed that an unauthorized party accessed an internal application used by its sales team, exposing business contact records and summaries of customer communications. The developer platform said it identified the intrusion on October 30, 2026, and that the attacker relied on an AI offensive security framework to automate reconnaissance and exploitation attempts. WorkOS said evidence gathered in its investigation indicates no WorkOS app data or production services were accessed or affected. The company did not specify how many customers or records were involved.
WorkOS provides APIs, SDKs, and tools that let developers add enterprise authentication, single sign-on, user management, and identity management to their applications. Its website states that at least 3,000 companies use its services, among them OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, Webglow, and Netlify. The affected system was an internal WorkOS application used by the sales team rather than a customer-facing product.
After detecting the intrusion, WorkOS cut off external access to the compromised application and reviewed access controls on its internal tools. The company also brought in an independent forensics and incident response firm to trace the unauthorized activity and assess its full impact. WorkOS said it will notify affected customers directly and cautioned users to watch for phishing or social engineering attempts that draw on the exposed information.
Company founder Michael Grinich provided additional details, saying the attacker used the ARTEX AI penetration testing suite. According to Grinich, investigators found user agents including artex-enrich/1.0 and norma/0.4 in web requests made by the threat actor. ARTEX AI was released earlier this year by Chinese developers as an open-source offensive security project, and it became private after being used in attacks on South Korean banks, though several forks of its code remain available.
The framework has appeared in other incidents this year. CrowdStrike recently reported that the cyber-espionage group Vapor Panda used the pentesting framework in a global campaign targeting 200 organizations. The non-profit cybersecurity organization DIVD also disclosed that the same framework powered attacks it suffered last September. Grinich said the WorkOS incident has been fully contained and that the company will share more information once the investigation concludes.
More cybersecurity news from TechManNews.
