---
id: "CMP-202611-ugcn2w"
kind: "campaign"
aliases: []
title: "WorkOS breached: attacker using the ARTEX AI framework got into an internal sales app and took customer contacts, account histories and sales/support call summaries"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "WorkOS", "fixed": [], "vendor": "WorkOS"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-03T22:18:46+00:00"
updated_at: "2026-11-03T22:20:17+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-03T22:18:46+00:00"}]
---

# WorkOS breached: attacker using the ARTEX AI framework got into an internal sales app and took customer contacts, account histories and sales/support call summaries

WorkOS (enterprise SSO, auth and user-management APIs used by 3,000+ companies) found unauthorized access to an internal application used by its sales team on 30 Oct 2026. The attacker took business contact details (names, emails, job titles, companies from the CRM), customer account histories (product usage, connection and directory health), summaries and excerpts of sales calls, support discussions and customer Slack conversations, and account relationship information. WorkOS says no app data or production services were accessed and the incident is contained. Founder Michael Grinich says the attacker used the ARTEX AI offensive framework (also used by VAPOR PANDA). WorkOS will notify affected customers directly; who is affected is not yet public.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :WorkOS affected ? fixed ?

## How to check

You are exposed if your company is a WorkOS customer (check for a direct notice from WorkOS). Expect phishing or social engineering that cites real details of your WorkOS account, sales calls or support/Slack threads. ARTEX requests in the attack used user agents 'artex-enrich/1.0' and 'norma/0.4'; search your own web and app logs for them.

## Fix

Treat unexpected messages that claim to be from WorkOS, or that quote your WorkOS account details, as possible phishing and verify them through a known contact. Warn staff who dealt with WorkOS sales or support. Block or alert on the user agents artex-enrich/1.0 and norma/0.4. No customer action on WorkOS credentials has been asked for so far.

## Timeline

- 2026-11-03T22:18:46+00:00 analyst

## Documents

- [describes] @BleepinComputer: WorkOS says attacker used ARTEX AI to breach internal sales app
https://t.co/kQ5 https://x.com/BleepinComputer/status/2117730885340414003
- [describes] BleepingComputer: WorkOS says attacker used ARTEX AI to breach internal sales app https://www.bleepingcomputer.com/news/security/workos-says-attacker-used-artex-ai-to-breach-internal-sales-app/

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_