WorkOS Says Attacker Used ARTEX AI to Access Internal Sales App
Summary
WorkOS says an attacker accessed its internal sales app on October 30, 2026, exposing business contacts and customer records. The company says production services and app data were unaffected and the incident is contained.
Key points
- WorkOS says it identified unauthorized access to an internal sales application on October 30, 2026.
- Accessed information included business contact details, customer account histories, and summaries or excerpts of customer communications.
- WorkOS says its app data and production services were not accessed or affected.
- The company says the attacker used ARTEX AI to automate reconnaissance and exploitation attempts; its founder cited the user agents ‘artex-enrich/1.0’ and ‘norma/0.4’ as evidence.
- WorkOS disabled external access to the affected application, reviewed internal-tool access controls, and hired an independent forensics and incident response firm.
- The company says the incident is contained and plans to notify affected customers, warning them about possible phishing or social engineering using the exposed information.
Article Details
- Victim Organization
- WorkOS
- Incident Type
- Unauthorized access to an internal sales application resulting in access to business contact records and customer communication summaries.
- Disclosure Date
- 2026-11-03
- Data Types Exposed
- Business contact details, including names, email addresses, job titles, and company affiliations
- Customer account histories, including product usage and connection or directory health
- Summaries and excerpts of sales calls, support discussions, and customer Slack conversations
- Business account and relationship information
- Operational Impact
- The attacker accessed an internal WorkOS application used by the sales team. WorkOS disabled external access to the application and reviewed access controls on internal tools. The company said WorkOS app data and production services were not accessed or affected, and that the incident was fully contained.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed