On October 30, an AI tool breached WorkOS

On October 30, 2026, WorkOS detected access to an internal application its sales team uses. The attacker accessed business contact records from the CRM (names, email addresses, job titles, company affiliations), customer account histories covering product usage and directory health, and summaries and excerpts from sales calls, support discussions, and customer Slack conversations. The company says no WorkOS app data and no production services were accessed or affected.

That boundary matters because of who WorkOS serves. It sells the identity plumbing (SSO, user management, enterprise auth APIs) behind at least 3,000 companies, including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, and Netlify. A breach of the sales CRM is a bad day. A breach of the auth layer those customers depend on would be a different category of event, and WorkOS is saying the intrusion did not cross into it.

The part that moves this out of routine-disclosure territory is the attribution. Founder Michael Grinich says the threat actor drove the attack with ARTEX AI, an AI-powered offensive security suite that automates reconnaissance and exploitation. The forensics team spotted it in the request logs: user-agent strings including artex-enrich/1.0 and norma/0.4 showing up in the attacker’s web traffic.

ARTEX AI has a short, busy history. Chinese developers released it earlier this year as an open-source offensive-security project. It went private after being used against South Korean banks, but forks of the code are still circulating. CrowdStrike has since tied it to the espionage group it tracks as Vapor Panda, which ran a global campaign against 200 organizations using the framework. The Dutch non-profit DIVD reported the same tool behind an intrusion it took last September. By the time it reached WorkOS, the framework already had a track record across banks, an espionage campaign, and a security non-profit.

For anyone running internet-facing internal tooling, the useful takeaways are specific.

The user agents are a detection signal, but a weak one. artex-enrich/1.0 and norma/0.4 are trivial to change, and any operator who reads this disclosure will change them. Treat them as a one-time IOC, not a durable control. The more durable signal is the behavior these frameworks produce: recon and exploitation attempts at a rate and breadth a human operator does not sustain, hitting endpoints in sequences that map to automated enumeration. If your logging can surface request-rate anomalies and systematic path probing against an internal app, that is what catches the next one.

Internal sales applications are a recurring soft spot, and this breach fits the pattern. They hold concentrated, high-value relationship data, they are often built or bought with less scrutiny than the core product, and they frequently have more external exposure than anyone intends. WorkOS’s first two moves after detection were to cut external access to the app and re-review access controls on internal tools, which is the right order and worth copying: assume your internal admin and sales apps are reachable until you have confirmed otherwise, and scope their permissions as if they will be breached.

The exposed data is built for follow-on social engineering. Names, titles, company affiliations, and actual excerpts from sales and support conversations give an attacker the material to write phishing that reads like a real thread. WorkOS has told customers to expect exactly this and to stay alert to phishing and social-engineering attempts that lean on the leaked context. If you are a WorkOS customer, that warning is concrete enough to act on: brief the people whose names and conversations likely sat in that CRM.

Grinich says the incident is now fully contained and that WorkOS will publish more detail once the independent forensics and incident-response firm it hired finishes its work. The company is notifying affected customers directly.

See also: NordVPN for tunneled traffic when operating outside controlled networks.

---

#ad Contains an affiliate link.