WorkOS Discloses Data Security Incident Involving AI-Assisted Attack

WorkOS has begun notifying its customers and stakeholders about a data security incident that was first detected on October 30, 2026. While the notice initially did not appear on the company’s public website or Trust center immediately following detection, affected parties received direct communications detailing the unauthorized access and the ongoing investigation into the breach.

According to the notification, WorkOS systems identified anomalous traffic directed toward an internal business system at 16:39 UTC on the day of the incident. Subsequent investigations revealed strong evidence that the attack was driven by ARTEX, an AI-assisted and autonomous penetration testing framework, originating from IP addresses located in Hong Kong and China. The unauthorized actor successfully breached an internal API utilized by the company’s sales and marketing tools, subsequently gaining entry to connected Salesforce and Snowflake data instances.

The compromised databases contained business contact details, commercial and account information, aggregated product usage metrics, marketing contacts, and customer support tickets. This included standard customer relationship management (CRM) data such as names, email addresses, phone numbers, and company mailing addresses for various WorkOS clients. However, the company emphasized that there is currently no evidence indicating that application data, production services, or core operational infrastructure were accessed or impacted, suggesting the breach was strictly contained to CRM and customer support repositories.

Sources: Hacker News

Aggregated summary. Original: Hacker News