Short answer
WorkOS said it found unauthorized access to an internal application used by its sales team on 30 October 2026. It says an AI-assisted offensive security framework automated the attacker's reconnaissance and that there is no evidence production services or WorkOS application data were reached.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | WorkOS |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Developer platform (enterprise authentication and SSO) |
| Country | United States |
| Detected | 2026-10-30 |
| Disclosed | 2026-11-02 |
| People or records affected | Not disclosed. WorkOS is still reviewing records to see which organizations are affected |
What data was exposed
- Business contact details from CRM systems: names, email addresses, phone numbers, job titles and company affiliations
- Customer account histories and sales and customer-relationship details
- Summaries and excerpts of sales calls, support discussions and customer Slack conversations
- Operational metadata such as product usage and connection or directory health
What happened
WorkOS provides sign-in, single sign-on and user management tools that other companies build into their products. In a security bulletin dated 2 November 2026, it said it identified unauthorized access to an internal application used by its sales team on 30 October. BleepingComputer reported the incident on 3 November.
WorkOS says it disabled external access to the application and is reviewing access controls on its other internal tools. It has hired an independent forensics and incident response firm to establish the full scope.
What data was involved
The affected application holds customer relationship data. WorkOS lists four categories: business contact details from its CRM, account histories and relationship details, summaries and excerpts of sales calls, support discussions and customer Slack conversations, and operational metadata such as product usage and directory connection health.
That is business information, not the sign-in credentials of end users. WorkOS says its current analysis indicates only CRM and customer support data was affected, and that there is no evidence that WorkOS application data or production services were touched. It has not said how many people or organizations are involved.
The AI-assisted angle
WorkOS says the attacker used an AI-assisted offensive security framework to automate reconnaissance and exploitation attempts. BleepingComputer reports that WorkOS founder Michael Grinich named the ARTEX AI suite and shared two user agent strings seen in the attacker’s web requests. These are WorkOS’s and its founder’s statements. No outside attribution of the attacker has been published in the sources we reviewed.
Why the data matters
Sales and support notes are useful to scammers because they contain real context: who talked to whom, about what, and when. A message that quotes a genuine conversation is far more believable than a generic one. WorkOS itself warns that contact details and past conversations could be used to make fraudulent requests look legitimate.
What to do
If you work with WorkOS, do not reply to unexpected messages that reference your account. Verify through a known contact, and log in through the official dashboard rather than any emailed link. WorkOS says it will notify affected customers directly and publish further updates on its bulletin page.
For general steps, see our data breach checklist. Messages that borrow details from real conversations are a common form of phishing and can lead to fake invoice and business email scams.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Targeted phishing or fake invoices that mention real sales calls, support tickets or Slack threads to look credible.
- Messages posing as WorkOS support or security asking you to log in, reset SSO settings or share directory sync credentials.
- Business email compromise attempts that use your job title and the names of colleagues you work with.
What to do if you are affected
- 01Treat unexpected messages that mention WorkOS, your account or past conversations as suspect until verified through a contact you already know.
- 02Do not enter credentials or approve SSO or directory changes from links in emails. Go to the WorkOS dashboard directly.
- 03Watch for WorkOS's direct notice if your organization is affected, and read the security bulletin for updates.
- 04Warn finance and IT staff who deal with WorkOS to double-check payment or access requests.
- 05If you keep logs of web requests, search for the user agents WorkOS named, artex-enrich/1.0 and norma/0.4, and investigate any hits.
Frequently asked questions
Was WorkOS production service or customer app data accessed?
WorkOS says it has no evidence that WorkOS application data or production services were accessed or affected. Its current analysis says only CRM and customer support data was involved. The investigation is ongoing.
What is ARTEX AI?
BleepingComputer describes ARTEX AI as an offensive security framework released as open source earlier in 2026, which later went private but has forks in circulation. WorkOS's founder said the attacker used it. WorkOS's own notice refers only to an AI-assisted offensive security framework.
How many people or companies are affected?
WorkOS has not said. It is reviewing affected records to work out the impact on individual organizations and says it will contact affected customers directly.
Should I rotate my WorkOS API keys?
WorkOS has not told customers to do so, because it says production services were not accessed. Its stated advice is to stay alert to phishing and verify unexpected requests.
Sources
- October 30th, 2026 data security incident, WorkOS, 2026-11-02
- WorkOS says attacker used ARTEX AI to breach internal sales app, BleepingComputer, 2026-11-03
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.