WorkOS, the company behind authentication and integration infrastructure used by other SaaS products, disclosed a data security incident in a security bulletin dated November 2, 2026. [1] The attack, the company says, ran through an internal API used by its sales and marketing tools and reached data in the company's Salesforce and Snowflake instances, where business contact details and support tickets are held. [2] The company also says it has found no evidence that customer application data or production WorkOS services were accessed. [2] For companies that run logins, enterprise SSO, or directory sync on WorkOS, the categories the company disclosed are the raw material of a convincing phishing message, and the task the evidence supports is defending against that message. That reading is this publication's analysis of the disclosed data categories, not a conclusion WorkOS issued.
WorkOS says it detected anomalous traffic to an internal business system at 16:39 UTC on October 30, 2026. [2] A customer notification email followed, and a recipient published its text on Hacker News on November 3. [2] The security bulletin, titled "October 30th, 2026 Data Security Incident," carries a November 2 date, [1] and WorkOS's chief executive confirmed the incident in writing in the same Hacker News thread. [2]
What WorkOS says was touched, and what it says was not
The notification email describes a specific path. An unauthorized actor, it says, gained access to an internal API used by the company's sales and marketing tools, and through that service reached data from Salesforce and Snowflake instances. [2] The systems hold, in the email's words, "business contact information, account and commercial information, aggregated and de-identified product usage metrics, marketing contacts, and support tickets," including CRM information such as "names, email addresses, phone numbers, company mailing addresses, and other business information for WorkOS customers." [2]
The same email draws the negative boundary in the company's own words. "We have no evidence that your application data was accessed," it states, and, "We also have no evidence that any production WorkOS services were accessed or impacted," adding that current analysis indicates the incident "was localized to only CRM and customer support data." [2] The chief executive wrote in the thread that "WorkOS's production systems are secure" and that the incident "was isolated to internal GTM systems," the company's term for the systems its go-to-market teams run. [2] These are the company's statements about its own systems, made while its investigation continues, and the email itself frames its findings as current.
On containment, the bulletin says WorkOS "disabled external access to the affected application," is "conducting a broader review of access controls on internal tools," and "retained an independent digital forensics and incident response firm to help establish the full scope of the activity and evaluate its impact." [1] The company's status page, a channel that tracks availability, carried an "All Systems Operational" banner and listed no unplanned availability incidents from October 30 through November 3; the only entry in that window was scheduled maintenance for the Events API on October 31. [4] Availability and security are different disclosures, and that page carries only the former.
For a customer deciding what applies to them, the company's account puts their contact details in scope and their application data and platform access out of scope, as of the company's current analysis. [2]
Why readable CRM data is a live risk
Read together, the categories WorkOS disclosed are the working materials of a targeted phishing approach. Names, work email addresses, phone numbers, and company mailing addresses identify who to contact. Support tickets carry the context that makes contact credible, a real product issue with a real timeline in the customer's own words. An email or call that cites those details reads as a continuation of the vendor relationship, which is what makes it dangerous.
The CRM entries the email describes are business contacts for WorkOS customers, [2] and the products on the company's own list include enterprise SSO, directory sync, and multi-factor authentication. [1] The people in those records are therefore close to the systems a phishing approach would most want to reach, the identity infrastructure of their own employers.
ARTEX, the tool in the disclosure, and the campaign that came before it
Both WorkOS documents attribute the attack to a tool. The email says the attack "was likely driven by ARTEX, an AI-assisted, autonomous penetration testing framework, from IP addresses based in Hong Kong and China." [2] The chief executive wrote, "The attack involved ARTEX, an autonomous AI agent framework used to carry out offensive security operations," and called it "a striking example of how quickly the capabilities of attackers are evolving." [2] Neither statement attributes the attack to a named actor or group.
Wiz's research, published October 22, eight days before WorkOS says it detected the traffic, supplies the tool's short history. A Chinese developer published ARTEX, an open-source autonomous penetration testing framework, on GitHub in July 2026, and it won Baidu's "Agent+" red team challenge that September. An operator supplies a target and an objective, a planner agent chooses the next step, worker agents run tools like nmap, curl, and Impacket, and every result feeds a shared graph of assets and findings. [3] Adoption followed within weeks. Wiz ties ARTEX artifacts to attacks on South Korean banks in late September and on Japanese companies in October, reports that Microsoft and Zscaler have tied the tooling to two separate actors, and notes the developer made the tool closed-source on October 8, by which point the code had more than 12,000 forks. [3]
In the Hacker News thread, one commenter asked why the framework matters. [2] Wiz's report is the concrete answer. It describes an actor using ARTEX tooling against multiple IT and software vendors through October 2026, with activity focused on identity providers including Okta, Entra, and Cognito and on abuse of Microsoft 365 integrations. [3] Wiz states those observations overlap with Microsoft's October 21 report on Storm-0940, whose title describes an AI-driven, large-scale, nation-state campaign using ARTEX to enable supply chain compromise. [3][5] WorkOS named a tool, not an actor. Wiz's report does not mention WorkOS, and both reports, published October 21 and October 22, predate the day WorkOS says it detected the traffic. [3][5] The wider campaign is context for the tool, not a finding about this incident. [3]
What customers can do now
WorkOS's own channels come first. The bulletin is published on the company's security site, [1] and the chief executive offered a direct path in the thread, "If you are a customer and would like to have a call with our security team, please send a note to security@workos.com." [2] The offer is open to any customer, so it also covers a company that did not receive the notification email. He also wrote, "We'll continue to share updates as we learn more." [2]
The commenters split on what the disclosure obliges. One urged readers to treat the incident as a full compromise and to change passwords and rotate keys. [2] Another replied that every company lives in a "no evidence" state at any given moment, that rotating credentials is reasonable caution, and that treating the incident as a full compromise implies more than the disclosure supports. [2] Whichever position a reader finds more convincing, the minimum response is the same, and this publication offers it as its own advice rather than as guidance from WorkOS. Treat any unexpected message or call that references your WorkOS account, a support ticket, or your company's contact details with suspicion, and verify it through a channel you already have, such as the bulletin page or the security email address above.
The judgment rests on the company's account of its own systems. The company framed that account as current and committed to share updates as it learns more. [2] The actions above cost little under either outcome of the investigation. The data that was read is data about customers, and the practical exposure begins with the messages those customers now receive.