· ai-devtools
WorkOS says attacker used ARTEX AI to breach internal sales app
Developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications.
According to the company, the attacker used an AI offensive security framework to automate reconnaissance and exploitation attempts. Based on evidence from the investigation, no WorkOS app data or production services were accessed or affected.
WorkOS is a developer infrastructure company that provides APIs, SDKs, and tools for integrating services such as enterprise authentication, single sign-on (SSO), user management, and identity management into applications. According to its website, at least 3,000 companies use its services, including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, Webglow, and Netlify.
"On October 30, 2026, we identified unauthorized access to an internal WorkOS application used by our sales team," the company says in an incident alert. Data accessed by the attacker includes: After detecting the intrusion, WorkOS disabled external access to the affected application and reviewed its access controls on internal tools. The company also contracted an independent forensics and incident response firm to track the unauthorized activity and determine its full impact.
