Skip to content
WorkOS Reports Data Breach Involving AI-Assisted Attack

WorkOS Reports Data Breach Involving AI-Assisted Attack

First seen 3 Nov 2026, 05:12 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 3, 2026 at 18:16 UTC
  • •Unauthorized access detected on October 30, 2026, via an AI-assisted attack.
  • •Data accessed includes CRM information and customer communications.
  • •WorkOS has disabled external access to the affected application and is investigating the breach.

On October 30, 2026, WorkOS detected unauthorized access to an internal application used by its sales team. The breach involved an AI-assisted penetration testing framework, ARTEX, reportedly originating from IP addresses in Hong Kong and China. Accessed data included CRM information such as names, email addresses, and customer communications. WorkOS has confirmed that no application data or production services were compromised, and they are currently investigating the incident further. An independent digital forensics firm has been retained to assess the full scope of the breach. External access to the affected application has been disabled, and a review of access controls is underway. The investigation is ongoing, and affected customers will be notified directly.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-30
Unauthorized access detected
WorkOS identified anomalous traffic and unauthorized access to an internal application used by sales teams.
Workos
2026-10-30
Investigation launched
WorkOS began investigating the breach, identifying ARTEX as the attack vector and disabling external access to the affected application.
Workos

More articles in this cluster (2)

Following this threat?

Track WorkOS in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 4

Common questions

What data was accessed?
The accessed data includes names, email addresses, phone numbers, and summaries of customer communications.
Is customer application data at risk?
WorkOS has stated there is no evidence that customer application data was accessed.
What steps is WorkOS taking?
WorkOS has disabled external access to the affected application and is conducting a thorough investigation with an independent firm.