WorkOS Confirms Data Breach via ARTEX AI Framework

Developer infrastructure provider WorkOS has confirmed a data breach involving its internal sales application. A threat actor utilised the ARTEX AI offensive security framework to gain unauthorised access to business contact records and summaries of customer communications.

The incident, identified on 30 October 2026, was restricted to internal tools. WorkOS confirmed that its production services and application data were not accessed or affected by the intrusion.

Details of the Compromised Data

The data accessed by the attacker includes business contact details such as names, email addresses, job titles, and company affiliations from customer relationship management (CRM) systems. The breach also involved customer account histories, including product usage and directory health information.

The attacker also obtained summaries and excerpts from sales calls, support discussions, and customer Slack conversations. This information pertains to business account histories and customer relationship details.

Use of ARTEX AI Framework

WorkOS founder Michael Grinich stated that investigators identified specific user agents, such as artex-enrich/1.0 and norma/0.4, in web requests from the threat actor. These indicators point to the use of ARTEX AI, an open-source penetration testing suite developed by Chinese developers.

The ARTEX AI framework has been linked to multiple cyberattacks this year, including breaches targeting South Korean banks. The cybersecurity firm CrowdStrike previously identified the framework as a tool used by the cyber-espionage group Vapor Panda in a global campaign targeting 200 organisations.

Incident Response and Customer Advice

Following the detection of the intrusion, WorkOS disabled external access to the affected application and reviewed its internal access controls. The company has contracted an independent forensics and incident response firm to determine the full impact of the activity.

WorkOS is notifying affected customers directly and has warned users to be vigilant for phishing or social engineering attempts that may exploit the exposed contact and relationship information.