WorkOS Breach: Attacker Used ARTEX AI on Its Sales App

WorkOS sells single sign on and directory sync to more than 3,000 companies. On October 30 an attacker skipped all of that and went for the app where WorkOS tracks its own customers. WorkOS says its product data and production systems were not reached. What it lost is worth more to an email scammer anyway: contact details plus the gist of real conversations with the admins who run WorkOS integrations.

Key Takeaways

• WorkOS identified unauthorized access to an internal application used by its sales team on October 30, 2026, and published a security bulletin dated November 2.
• The exposed data includes names, email addresses, phone numbers, job titles, account histories, and "summaries and excerpts from sales calls, support discussions, and customer Slack conversations."
• WorkOS says there is "no evidence that WorkOS application data was accessed" and no evidence that production services were touched.
• Founder Michael Grinich attributed the attack to ARTEX, an AI offensive framework, after spotting the user agents artex-enrich/1.0 and norma/0.4 in the attacker's web requests.
• Contact records plus real conversation details let an attacker write phishing emails that cite a genuine support ticket or sales call, a risk WorkOS itself flags.

What Did WorkOS Disclose?

WorkOS disclosed that an outsider reached an internal tool used by its sales and customer facing teams, and that the intrusion touched only CRM and customer support data. The WorkOS security bulletin opens with a single sentence of fact: "On October 30, 2026, we identified unauthorized access to an internal WorkOS application used by our sales team."

It lists four categories of affected data:

• Business contact details: names, email addresses, phone numbers, job titles and company affiliations held in CRM systems.
• Account and relationship information: account histories plus sales and customer relationship notes.
• Customer communications: summaries and excerpts from sales calls, support discussions and customer Slack conversations.
• Operational metadata: product usage and "connection or directory health."

The company disabled external access to the application, is reviewing access controls on other internal tools and has hired an outside forensics firm. It names no CRM vendor, no entry point and no start date. It also does not directly address the end users who sign in through customers' apps; its claim is that no WorkOS application data and no production services were reached.

What Is ARTEX?

ARTEX is an autonomous penetration testing framework that chains AI agents together to run an intrusion from reconnaissance onward. According to Wiz's October 22 analysis, a Chinese developer published it on GitHub in July 2026, then "made the tool closed-source on October 8," by which point the code had "more than 12,000 forks." Closing the repository did not take those copies offline.

CrowdStrike's October 29 report on Vapor Panda describes the architecture: "ARTEX coordinates a main agent with subordinate planner and worker agents over a shared graph of facts, findings, and goals." Vapor Panda pointed it at "more than 200 distinct organizations worldwide" across at least 14 countries in an 11 day window, and in one intrusion the planning agents burned through "on the order of 1.4 billion input tokens."

In September, DIVD said an AI agent it attributes to ARTEX chained two zero days to reach root on its own network, as covered in the Zammad zero days report.

How Was ARTEX Linked to the WorkOS Attack?

Through user agent strings in the attacker's web traffic, not through any confirmed artifact of the tool itself. The bulletin only mentions "an AI-assisted offensive security framework." The name came from Grinich, who posted on X that his team saw the user agents artex-enrich/1.0 and norma/0.4, which, based on Wiz's reporting and the open source forks, "are likely attributable to ARTEX."

One of those strings can be checked. norma/0.4 sits in the indicator table of the Wiz report, which tracks an actor overlapping with the Chinese group Storm-0940 that targeted "multiple IT and software vendors," with a focus on identity providers such as Okta and Entra ID. artex-enrich/1.0 does not appear in that report. WorkOS fits that victim profile, but it has named no threat actor, and nothing public ties this break in to Storm-0940 or Vapor Panda.

A caution: a user agent is a header the client picks. Wiz saw "more than 15 different user-agent strings" in its campaign, and any fork can drop both names.

What This Means for Your Inbox

An attacker holding a call summary knows which feature you asked about and who you spoke to. That is the raw material of spear phishing. WorkOS says as much in its bulletin: "Business contact information and details from previous conversations can help an attacker make fraudulent requests look legitimate."

The "connection or directory health" field deserves more attention than it is getting. For a company that sells SSO and directory sync, that metadata can show which customers have a misconfigured or failing integration. An email telling an admin that a broken SSO connection needs reauthorizing at a lookalike portal is exactly the message that admin expects. WorkOS has not said the field was abused, and its customer page lists OpenAI and Anthropic without saying whose records were in the app.

This is the second agentic breach of customer contact data disclosed in a week. On October 30, the same day WorkOS spotted its intruder, Chainalysis disclosed an agentic attack that exposed customer names and emails, though Chainalysis named no tool. A familiar sender name is no reassurance either: after the Brevo breach, attackers sent a fake Trezor security alert from Trezor's own mailing list.

What Should WorkOS Customers and Defenders Do Now?

Assume your WorkOS contacts are known to the attacker and verify every unexpected request through a channel you already trust. Concretely:

• Brief the named contacts first. The people who talked to WorkOS sales or support are the ones in the CRM. A message quoting a real ticket or call is not proof of identity.
• Never reconfigure SSO or directory sync from an email link. Change connection settings only in the dashboard you normally use, after confirming with your existing account contact.
• Move admin accounts to phishing resistant MFA. CISA's fact sheet states that "the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication."
• Hunt for the user agents in your own logs. Search web, WAF and identity provider logs for artex-enrich/1.0 and norma/0.4; a clean result proves little.
• Add CrowdStrike's ARTEX markers to detections. The Vapor Panda report flags command lines containing "artx" or "artex" and artx prefixed cloud roles. It also lists a C:\ProgramData\artx5v\ directory.
• Watch your sign in pages for sustained spraying. Wiz saw ARTEX sessions last 24 to 30 hours, with new addresses appearing within minutes of a block, so per IP rate limits fall short.

WorkOS says it will contact affected customers directly, and BleepingComputer reports Grinich promised more once the investigation ends. Until then, ask for the exact fields tied to your account, and treat the sales stack around any vendor as part of its attack surface. The data in it is written in the language of your inbox.