WorkOS reports security breach

WorkOS has notified clients of a data security incident detected on October 30, 2026, at 16:39 UTC. The company identified anomalous traffic to an internal business system, with evidence suggesting the attack was driven by ARTEX, an AI-assisted autonomous penetration testing framework, from IP addresses in Hong Kong and China. The unauthorized actor accessed an internal API utilized by sales and marketing tools, which provided entry to Salesforce and Snowflake instances.

The compromised data includes business contact information, account and commercial details, aggregated product usage metrics, marketing contacts, and support tickets. Specific CRM information affected comprises names, email addresses, phone numbers, and company mailing addresses for WorkOS customers. WorkOS stated there is no evidence that application data or production services were accessed or impacted, indicating the incident was localized to CRM and customer support data. The company noted that the breach notification has not yet been posted on its website or Trust center.