Identity and authentication company WorkOS has disclosed a breach of an internal application used by its sales team, after an attacker used an AI-assisted offensive security framework to automate reconnaissance and exploitation attempts. The company detected the unauthorised access on 30 October 2026 and published a security bulletin on 2 November.

The affected application gave access to business contact details held in the company’s customer relationship management systems, including names, email addresses, phone numbers, job titles and company affiliations, as well as account and relationship information. Most strikingly, it also held summaries and excerpts from sales calls, support discussions and customer Slack conversations, along with operational metadata such as product usage and connection or directory health information.

ARTEX named as the framework

WorkOS’s bulletin describes an AI-assisted offensive security framework, but does not name it. Its chief executive, Michael Grinich, made the link explicit, saying on X and on Hacker News that the attack involved ARTEX, an autonomous AI agent framework used to carry out offensive security operations, and telling BleepingComputer that user-agents including artex-enrich/1.0 and norma/0.4 appeared in web logs. Google’s threat intelligence team has described ARTEX as an autonomous, multi-agent, LLM-driven pentesting and offensive command-and-control platform.

WorkOS says there is no evidence that WorkOS application data was accessed, and no evidence that production services were accessed or impacted: the incident affected only CRM and customer support data. The company says it has disabled external access to the affected application, is reviewing access controls on its internal tools, and has hired an independent forensics and incident response firm. The investigation is ongoing, and WorkOS says it will contact affected customers directly.

Sources: BleepingComputer, WorkOS says attacker used ARTEX AI to breach internal sales app, 3 November 2026; On The Wire, WorkOS discloses breach of internal sales tool, says attackers used an AI-assisted framework, 3 November 2026.