WorkOS breached: attacker using the ARTEX AI framework got into an internal sales app and took customer contacts, account histories and sales/support call summaries

WorkOS (enterprise SSO, auth and user-management APIs used by 3,000+ companies) found unauthorized access to an internal application used by its sales team on 30 Oct 2026. The attacker took business contact details (names, emails, job titles, companies from the CRM), customer account histories (product usage, connection and directory health), summaries and excerpts of sales calls, support discussions and customer Slack conversations, and account relationship information. WorkOS says no app data or production services were accessed and the incident is contained. Founder Michael Grinich says the attacker used the ARTEX AI offensive framework (also used by VAPOR PANDA). WorkOS will notify affected customers directly; who is affected is not yet public.

Summary written from the sources below. Check the originals before acting.