WorkOS Breach: Attacker Uses ARTEX AI Framework to Compromise Internal Sales App
WorkOS, a developer infrastructure company whose APIs and SSO/identity tools are used by over 3,000 companies including OpenAI, Anthropic, Cursor, Perplexity, and Snowflake, disclosed a data breach affecting an internal sales application. The company detected unauthorized access on October 30, 2026, and says no production services or app data were impacted. The attacker exfiltrated business contact details, customer account histories, summaries of sales/support communications, and business relationship data from CRM and internal tools. WorkOS attributes the intrusion to use of the ARTEX AI offensive security framework, an AI-powered pentesting suite used to automate reconnaissance and exploitation.
Detalhes técnicos
WorkOS founder Michael Grinich said investigators identified user agents such as artex-enrich/1.0 and norma/0.4 in the attacker's web requests, pointing to use of ARTEX AI, an open-source Chinese-developed offensive security platform released earlier this year. The tool went private after being used against South Korean banks, though forks remain publicly available. The same framework has reportedly been used by the espionage group tracked by CrowdStrike as Vapor Panda in a campaign against roughly 200 organizations, and was also linked to an attack against the non-profit DIVD in September.
Remediação
WorkOS disabled external access to the affected sales application, reviewed internal access controls, and engaged an independent forensics and incident response firm. The company plans to directly notify affected customers and has warned them to watch for phishing or social engineering attempts leveraging the exposed business contact and communication data.
Linha do tempo
-
WorkOS Breach: Attacker Uses ARTEX AI Framework to Compromise Internal Sales App
ler a análise desta fonte ocultar
WorkOS, a developer infrastructure company whose APIs and SSO/identity tools are used by over 3,000 companies including OpenAI, Anthropic, Cursor, Perplexity, and Snowflake, disclosed a data breach affecting an internal sales application. The company detected unauthorized access on October 30, 2026, and says no production services or app data were impacted. The attacker exfiltrated business contact details, customer account histories, summaries of sales/support communications, and business relationship data from CRM and internal tools. WorkOS attributes the intrusion to use of the ARTEX AI offensive security framework, an AI-powered pentesting suite used to automate reconnaissance and exploitation.
Technical Details
WorkOS founder Michael Grinich said investigators identified user agents such as
artex-enrich/1.0andnorma/0.4in the attacker's web requests, pointing to use of ARTEX AI, an open-source Chinese-developed offensive security platform released earlier this year. The tool went private after being used against South Korean banks, though forks remain publicly available. The same framework has reportedly been used by the espionage group tracked by CrowdStrike as Vapor Panda in a campaign against roughly 200 organizations, and was also linked to an attack against the non-profit DIVD in September.Remediation
WorkOS disabled external access to the affected sales application, reviewed internal access controls, and engaged an independent forensics and incident response firm. The company plans to directly notify affected customers and has warned them to watch for phishing or social engineering attempts leveraging the exposed business contact and communication data.