WorkOS breached by AI-driven autonomous pentest framework ARTEX, CRM data exposed
werrett · hn · 2026-11-03
WorkOS has notified customers of a data security incident detected on October 30, 2026 at 16:39 UTC, when it spotted anomalous traffic to an internal business system. Its investigation found the attack was likely driven by ARTEX, an AI-assisted autonomous penetration-testing framework, from IPs based in Hong Kong and China.
- The actor reached an internal API used by sales and marketing tools, then accessed data in Salesforce and Snowflake.
- Exposed data includes CRM contact details (names, emails, phones, company addresses), account and commercial information, aggregated de-identified product usage metrics, marketing contacts and support tickets.
- WorkOS says there is no evidence customer application data or production services were accessed or impacted; the incident appears limited to CRM and support data.
- The notice is not yet on the company website or Trust Center, and the investigation continues.
More from Safety
- OpenAI retroactively applies raised bug bounty rates to reports from the past 30 days — OpenAI · 2026-11-03
- OpenAI quadruples critical bug bounties to $172,000 and brings outside red team to attack its own defenses — OpenAI · 2026-11-03
- AI finds exploits faster than humans patch; ex-Oculus founder says agents must own the first hour — alvelda · 2026-11-03
- Ramez Naam on Plural AI: Competition Plus Open Weights Beats One-Lab Monopoly for Safety — sebkrier · 2026-11-03
- Agents Are Now Driving Reverse Engineering: REA Course Maps the Free Ghidra-to-pwntools Toolchain — blaizedsouza · 2026-11-03
- AI safety researchers should falsify claims in model cards, argues viral tweet — jammastergirish · 2026-11-03