WorkOS, which sells login and identity tools to software companies, disclosed on November 2, 2026 that an attacker got into one of its internal sales tools on October 30. Its bulletin says the attacker used “an AI-assisted offensive security framework to automate reconnaissance and exploitation attempts.” CEO Michael Grinich named the framework on X the same day: “The attack involved ARTEX, an autonomous AI agent framework used to carry out offensive security operations.”
The company says its product was not touched: “We have no evidence that production WorkOS services were accessed or impacted. Our current analysis indicates this incident affected only CRM and customer support data.”
WorkOS is the latest name in a two-month run of attacks that security firms tie to ARTEX. Below: what was taken, what ARTEX is, the other campaigns reported, and what a small company should take from it.
On this page · 8 sectionsOpen
WorkOS disclosed on November 2, 2026 that an attacker reached an internal sales tool on October 30 and took CRM and customer support data.
CEO Michael Grinich says the attack used ARTEX, an open-source framework in which AI agents run penetration-testing steps on their own.
The taken data includes call and support summaries, which WorkOS warns could make phishing emails look legitimate.
Security firms tie ARTEX to other campaigns since September, including attempted sign-ins to more than 2,250 tenants (Microsoft).
WorkOS says no production systems were accessed and it has cut external access to the tool.
§ 01How an agentic attack reaches a CRM
WorkOS describes the general pattern: AI agents “can choose follow-up actions based on a target’s responses and automate multi-step attack sequences.” That raises the speed and scale of attacks on “exposed applications and stolen credentials.” The agent does not need a new kind of flaw. It needs an internal tool that can be reached from outside and a login that works.
§ 02What WorkOS says was taken
| Category | What it held |
|---|---|
| Business contact details | Names, emails, phone numbers, job titles and company affiliations from the CRM |
| Account and relationship information | Customer account histories and sales relationship notes |
| Customer communications | Summaries and excerpts of sales calls, support discussions and customer Slack conversations |
| Operational metadata | Product usage and connection or directory health |
The last two rows are the uncomfortable ones. Call summaries and support threads are what make a fake email believable, and WorkOS says so directly: “Even when a message references a real colleague or support conversation, verify unexpected requests before sharing sensitive information or taking action.”
WorkOS says it disabled external access to the tool, is reviewing access controls on its other internal tools, has hired an outside incident response firm, and will contact affected customers directly.
§ 03What ARTEX is
ARTEX is an open-source, multi-agent penetration-testing framework. Google’s Threat Intelligence Group describes a Go application with a web console in which several AI agents coordinate a test. It was published on GitHub by a user called Autumn-27 for authorized security testing. Google says the original repository “was taken down by its creator in October 2026 due to widespread threat actor abuse,” but forks keep it in circulation. It is not a model: it calls whichever language model the operator plugs in.
§ 04The campaigns security firms have tied to it
| Reported by | Who and when | What they found |
|---|---|---|
| CrowdStrike | Unattributed actor, late September to early October | Breaches of South Korean financial organizations with data stolen; ARTEX ran on DeepSeek v4.1-flash, with GLM-5.3 and Grok 4.6 in extra sessions |
| Microsoft (October 21) | Storm-0940, a China-state aligned actor, from as early as September | ARTEX used to attempt sign-ins to more than 2,250 tenants; tied to the ConnectWise supply chain compromise |
| CrowdStrike | VAPOR PANDA, from October 17 | ARTEX used against more than 200 organizations; post-exploitation confirmed at nine |
| Google (October 30) | Multiple actors, financial and suspected state-linked | Forks keep spreading after the original repository came down |
| WorkOS (November 2) | Attacker not named | Internal sales tool reached on October 30; CRM and support data taken |
Microsoft’s report puts the speed plainly: in one case the time “from initial targeting to privileged access was less than 3 hours.”
§ 05What WorkOS has not said
- The entry point. The bulletin does not say how the attacker reached the tool, for example a stolen login or an exposed endpoint.
- The attacker. No actor is named, and the bulletin itself never says ARTEX; that name comes from Grinich’s post.
- How many customers. WorkOS is still reviewing records to see which organizations are affected.
- Timeline. It gives the discovery date, not when the access began.
§ 06What a small company should take from it
The lesson is not that AI agents found a new kind of hole. They work through the old ones faster: an internal app open to the internet, a password that still works, an account nobody removed. WorkOS’s own response is the checklist. Cut external access to internal tools that do not need it, review who can log in to each one, and warn customers that stolen call notes make phishing look real.
Small teams rarely have someone whose job is that review. Our position, declared: we build CellCog, where AI employees hold logins to your tools, so this is our problem too. On CellCog, each employee works in its own secure computer and every action that reaches the outside world is classified, and anything above the owner’s chosen level waits for a human yes (see our record of an AI agent on a Pentagon network for what happens without that).
§ 07What we are watching
- The entry point. Whether WorkOS publishes how the attacker got in.
- More disclosures. Whether other software companies report ARTEX intrusions into internal tools.
- Forks. Whether GitHub and other hosts act on the copies Google says keep spreading.
§ 08Sources
- WorkOS: October 30th, 2026 Data Security Incident, November 2, 2026, read the same day.
- Michael Grinich on X: incident post, November 2, 2026.
- Google Threat Intelligence: ARTEX and friends enter agentic offensive frameworks, October 30, 2026.
- Microsoft Security: Storm-0940 uses ARTEX, October 21, 2026.
- CrowdStrike: ARTEX against South Korean finance and VAPOR PANDA.
Q1Was WorkOS's product breached?
WorkOS says it has no evidence production services were accessed and that the incident affected only CRM and customer support data.
Q2Who named ARTEX?
WorkOS CEO Michael Grinich, in a post on X on November 2, 2026. The WorkOS bulletin describes an AI-assisted offensive security framework without naming it.
Q3Which models does ARTEX use?
Whichever the operator connects. In one campaign CrowdStrike found DeepSeek v4.1-flash as the main model, with GLM-5.3 and Grok 4.6 in extra sessions.
Q4Who else has been hit with ARTEX?
Security firms report South Korean financial organizations, a Storm-0940 campaign Microsoft tied to the ConnectWise compromise, and a VAPOR PANDA campaign against more than 200 organizations.
Q5How did the attacker get into the WorkOS tool?
WorkOS has not said. Its investigation, with an outside incident response firm, is ongoing.