Hackers used an AI attack tool to break into WorkOS sales system

WorkOS, a company that handles sign-in features for other businesses' software, says an attacker broke into one of its internal sales tools. The attacker used an AI-powered hacking framework called ARTEX AI to speed up the attempt. WorkOS says it spotted the access on October 30, 2026.

What happened

The affected system was an internal app used by the WorkOS sales team. The attacker could see business contact records and summaries of customer communications. WorkOS says its investigation found no sign that customer app data or production services, the live systems customers rely on, were accessed or affected.

After finding the intrusion, WorkOS cut off outside access to the app and reviewed access controls on its other internal tools. It also hired an independent firm to investigate and work out the full impact. Founder Michael Grinich says the incident is now fully contained.

What ARTEX AI is

ARTEX AI is a penetration testing suite. That is a kit security teams normally use to probe their own systems for weak spots. Chinese developers released it earlier this year as an open-source project, meaning anyone could view and copy the code. It later became private after it was used in attacks on South Korean banks, but several copies of its code are still available.

It has turned up in other incidents too. CrowdStrike said a spy group it calls Vapor Panda used it in a global campaign aimed at 200 organizations. The nonprofit DIVD said the same framework powered attacks against it last September.

Grinich said investigators spotted tool names in the attacker's web requests, including 'artex-enrich/1.0' and 'norma/0.4'.

Who it affects

WorkOS provides tools for enterprise sign-in and single sign-on, which lets employees use one login across many work apps. Its website says at least 3,000 companies use it, including OpenAI, Anthropic, Snowflake, Plaid and Netlify. The material does not say which customers, or how many, had their information exposed. WorkOS says it will contact affected customers directly.

What to do

WorkOS warned people to stay alert for phishing and social engineering. Those are messages that trick you into clicking, paying or sharing something by pretending to be someone you know. Stolen contact details and conversation summaries can make such messages look real.

• Be wary of unexpected emails that mention real details about your dealings with a vendor.
• Check unusual requests through a phone number or contact you already trust.
• Do not click links or open attachments you did not expect.

What happens next

The investigation is still running. WorkOS has promised to share more about the attack once it finishes. Still unknown is how the attacker got into the sales app and how many records were seen.