WorkOS detected a data security incident on October 30, 2026, involving unauthorized access to internal systems. The breach was likely driven by ARTEX, an AI-assisted autonomous penetration testing framework originating from Hong Kong and China. An unauthorized actor accessed an internal API used by sales and marketing tools, gaining entry to Salesforce and Snowflake instances.
The compromised data includes business contact information, account details, aggregated product usage metrics, marketing contacts, and support tickets. This encompasses names, email addresses, phone numbers, and company mailing addresses for WorkOS customers. The company confirms no evidence exists that application data or production services were accessed or impacted.
The incident appears localized to CRM and customer support data. WorkOS states they are continuing their investigation and will update their website and Trust center once available. The notification was received directly as the incident has not yet been posted to official channels.
This breach highlights ongoing security challenges for AI-assisted penetration testing and the vulnerability of integrated cloud services like Salesforce and Snowflake to sophisticated external threats targeting customer data repositories.
Source: Hacker News · Summarized by HeadlinesBriefing