Overview
SecurityWeek reports that hackers have been harvesting AI access tokens and using AI-assisted offensive tools to automate attacks. Three developer-platform companies, WorkOS, Northflank and Trigger.dev, have recently disclosed breaches.
WorkOS
According to WorkOS's disclosure dated October 30, 2026, attackers compromised an internal application used by its sales team. The report says the attack relied on the open-source AI penetration-testing framework Artex for automation.
Data affected includes business contact details (names, email addresses, phone numbers, job titles, company affiliations) and summaries of customer communications. It also covers customer account histories, sales details, customer-relationship information, and information about how customers use WorkOS products.
Northflank and Trigger.dev
Both companies disclosed incidents, but the SecurityWeek article does not describe their attack paths, dates or the exact data taken. Their official disclosures and status pages are the authoritative sources. The article says that across these incidents attackers were mainly seeking stored customer secrets.
Common Threads
- Targets are developer platforms that hold tokens and secrets for many downstream customers
- Initial access varied, from compromised credentials to third-party dependencies and vulnerability exploitation
- AI access tokens are valued because they can be monetized directly
Recommendations
- Rotate API keys, AI provider tokens and secrets stored in or shared with affected platforms.
- Review audit logs for unusual token use, especially against AI services.
- Scope tokens narrowly and set spend limits on AI provider keys.
- Expect targeted phishing if you are a WorkOS customer, since contact details and communication summaries were exposed.
- Follow each vendor's official incident notices for updates.