VULNpocalypse
MediumBreach / campaignMonitoring

WorkOS says an attacker used the ARTEX AI agent to breach an internal sales app

On 30 October 2026 WorkOS found an attacker had used the ARTEX AI pentest agent to breach an internal sales app and read CRM and customer records.

Published
Updated
Exploitation
Yes. On 30 October 2026 an attacker reached an internal WorkOS sales app; WorkOS says no app data or production services were accessed (BleepingComputer)

What happened

WorkOS, a developer platform for enterprise SSO, user management and identity, disclosed that “On October 30, 2026, we identified unauthorized access to an internal WorkOS application used by our sales team” (BleepingComputer). WorkOS says at least 3,000 companies use its services, and its website lists OpenAI, Anthropic and Cursor among them (BleepingComputer).

How the attacker operated. WorkOS founder Michael Grinich said the attacker used ARTEX AI, an AI driven offensive security framework, to automate reconnaissance and exploitation. Investigators found the user agents “artex-enrich/1.0” and “norma/0.4” in the attacker’s web requests (BleepingComputer). ARTEX is an open source autonomous penetration testing framework published on GitHub by a Chinese developer in July 2026; an operator sets a target and objective, a planner agent chooses the next steps, and worker agents run tools such as nmap, curl and Impacket. The developer made it closed source on 8 October 2026, by which point it had more than 12,000 forks (Wiz).

What was accessed. Per WorkOS, the internal sales application held (BleepingComputer):

  • Business contact details from CRM systems (names, emails, job titles and company affiliations)
  • Customer account histories, including product usage and connection or directory health
  • Customer communications, including summaries and excerpts from sales calls, support discussions and customer Slack conversations
  • Business account and relationship information

What WorkOS says was not affected. WorkOS stated that “no WorkOS app data or production services were accessed or affected” (BleepingComputer). Whether any authentication credentials, secrets or tokens were exposed is not confirmed; the reporting does not separately address those (BleepingComputer).

Attribution. No attribution of the WorkOS incident itself has been made. For wider context, BleepingComputer reports that CrowdStrike linked the ARTEX framework to a cyber espionage group it calls “Vapor Panda”, which targeted about 200 organizations (BleepingComputer). Microsoft separately attributes ARTEX activity to a China state aligned group it tracks as Storm-0940, saying the group has used the framework since at least September 2026 and targeted more than 2,250 Microsoft 365 tenants at 2,900 sign in attempts per minute (CSO Online). Whether the WorkOS attacker is the same actor is not confirmed.

WorkOS’s response (BleepingComputer):

  • Disabled external access to the affected application after detecting the intrusion.
  • Reviewed access controls on internal tools.
  • Hired an independent forensics and incident response firm to track the activity and assess its full impact.
  • Said it will notify affected customers directly, and warned users to watch for phishing and social engineering using the exposed information.
  • Grinich said the incident “has now been fully contained” and promised more details after the investigation concludes.

Am I affected?

  • You may be affected if your company is a WorkOS customer or sales prospect. The exposed data is business and relationship information held in WorkOS’s own internal sales tool: CRM contact details, account histories and excerpts of sales, support and customer Slack conversations (BleepingComputer). WorkOS says it will notify affected customers directly (BleepingComputer).
  • Your WorkOS integration and end user logins are not described as affected. WorkOS says no WorkOS app data or production services were accessed or affected (BleepingComputer). Exposure of authentication credentials, API keys or tokens is not confirmed either way (BleepingComputer).
  • The main downstream risk is targeted phishing. The exposed records tie real names, roles and company relationships to the details of past conversations with WorkOS, which makes convincing lures easier to craft (BleepingComputer).

What to do now

  1. Watch for WorkOS’s direct notice. WorkOS says it will contact affected customers; confirm your security and billing contacts will receive it (BleepingComputer).
  2. Brief staff on follow on phishing. Treat messages that reference your WorkOS account, a sales or support thread, or a Slack conversation as potential social engineering, exactly as WorkOS warned (BleepingComputer). Verify any request to change payment, credentials or configuration through a known channel, not by replying.
  3. Review your WorkOS integration for anything sensitive you shared out of band. If API keys, secrets or configuration details were ever discussed in sales or support conversations, rotate them as a precaution, since WorkOS has not confirmed whether credentials were in scope (BleepingComputer).
  4. Harden your own identity surface against agentic AI attacks. ARTEX style agents map applications from JavaScript bundles and OpenAPI docs, probe OAuth callbacks and unsigned JWTs, password spray Okta and Entra ID, and abuse password reset and tenant isolation (Wiz). Review authentication logs for high rate sign in attempts and rotating user agents or IPs.
  5. If you run Microsoft 365, follow Microsoft’s Storm-0940 guidance. Microsoft urged reviewing activity from at least 15 October 2026, extending back to 1 October where records allow, and watching for application credential changes and privileged role changes used for persistence (CSO Online).

Sources