Overview
Developer platform WorkOS has disclosed a data breach affecting an internal application used by its sales team. The company says it identified the unauthorized access on October 30, 2026 and disclosed it on November 2. WorkOS founder Michael Grinich told reporters the attacker used the ARTEX AI offensive-security framework.
What Was Exposed
According to reporting by BleepingComputer, the affected application held:
- CRM business contact records: names, email addresses, job titles, and company affiliations
- Customer account histories and product usage data
- Summaries and excerpts of sales calls, support discussions, and customer Slack conversations
WorkOS says its investigation found no evidence that production services or customer application data were accessed.
The ARTEX Angle
Grinich said investigators saw user agents such as artex-enrich/1.0 and norma/0.4 in the attacker's requests, which pointed to ARTEX. Reports describe ARTEX as an AI-driven penetration-testing suite released by Chinese developers earlier this year as open source. It was later made private after reports of its use against South Korean banks, though forks of the code remain available.
Note that the official WorkOS bulletin reportedly describes only an "AI-assisted offensive framework" and does not name ARTEX; the attribution to the tool comes from the CEO's comments.
Response
WorkOS disabled external access to the affected application, engaged an independent digital forensics and incident response firm, and is reviewing access controls across its internal tools.
Risk to Customers
The main downstream risk is targeted phishing. Call and support summaries give an attacker realistic context, so messages impersonating WorkOS staff or referencing real conversations could look convincing.
Recommendations
- Treat unexpected WorkOS-related emails, especially those referencing past calls or tickets, with suspicion and verify through a known channel
- Do not click links or share credentials in response to unsolicited messages
- Review which vendor tools hold summaries of your communications, and apply least-privilege and strong authentication to internal sales and CRM apps
- Watch for automated, high-volume enumeration against internal apps; AI-driven tooling makes such activity faster and cheaper