# WorkOS Breach: An AI Agent Framework Got In, Explained

> WorkOS says an AI agent framework, ARTEX, reached an internal sales tool and took CRM data. What was taken, what ARTEX is and the other attacks.

- Author: Nitish Garg, Founder & CEO, CellCog
- Published: 2026-11-03
- Canonical (HTML): https://cellcog.ai/blog/workos-artex-breach/
- Section: Guides / Trust, permissions & security
- Publisher: CellCog (https://cellcog.ai), the AI employee platform. Blog index for agents: https://cellcog.ai/blog/llms.txt

## Key points

- WorkOS disclosed on November 2, 2026 that an attacker reached an internal sales tool on October 30 and took CRM and customer support data.
- CEO Michael Grinich says the attack used ARTEX, an open-source framework in which AI agents run penetration-testing steps on their own.
- The taken data includes call and support summaries, which WorkOS warns could make phishing emails look legitimate.
- Security firms tie ARTEX to other campaigns since September, including attempted sign-ins to more than 2,250 tenants (Microsoft).
- WorkOS says no production systems were accessed and it has cut external access to the tool.

## At a glance

- **What happened at WorkOS?** On October 30, 2026 WorkOS found unauthorized access to an internal sales tool. Business contacts, account notes and call and support summaries were exposed; production systems were not, it says.
- **What is ARTEX?** An open-source framework in which several AI agents run penetration-testing steps. It was built for authorized testing; its creator took the original down in October 2026, but forks circulate.
- **What should customers do?** WorkOS says to verify unexpected requests, even ones that reference a real colleague or support conversation, before sharing data or acting.

WorkOS, which sells login and identity tools to software companies, disclosed on November 2, 2026 that an attacker got into one of its internal sales tools on October 30. Its bulletin says the attacker used "an AI-assisted offensive security framework to automate reconnaissance and exploitation attempts." CEO Michael Grinich named the framework on X the same day: "The attack involved ARTEX, an autonomous AI agent framework used to carry out offensive security operations."

The company says its product was not touched: "We have no evidence that production WorkOS services were accessed or impacted. Our current analysis indicates this incident affected only CRM and customer support data."

WorkOS is the latest name in a two-month run of attacks that security firms tie to ARTEX. Below: what was taken, what ARTEX is, the other campaigns reported, and what a small company should take from it.

## How an agentic attack reaches a CRM

![Animated diagram: ARTEX agents scan, try logins and reach an exposed internal tool, then pull CRM data; the stolen contact details and call notes feed the next risk, convincing phishing](https://cellcog.ai/blog/media/workos-artex-breach/chain.svg)
*ARTEX agents chain the steps a human attacker would run by hand*

WorkOS describes the general pattern: AI agents "can choose follow-up actions based on a target's responses and automate multi-step attack sequences." That raises the speed and scale of attacks on "exposed applications and stolen credentials." The agent does not need a new kind of flaw. It needs an internal tool that can be reached from outside and a login that works.

## What WorkOS says was taken

*Table: Data in the affected WorkOS sales tool, per its bulletin (read November 2, 2026)*

| Category | What it held |
|---|---|
| Business contact details | Names, emails, phone numbers, job titles and company affiliations from the CRM |
| Account and relationship information | Customer account histories and sales relationship notes |
| Customer communications | Summaries and excerpts of sales calls, support discussions and customer Slack conversations |
| Operational metadata | Product usage and connection or directory health |

The last two rows are the uncomfortable ones. Call summaries and support threads are what make a fake email believable, and WorkOS says so directly: "Even when a message references a real colleague or support conversation, verify unexpected requests before sharing sensitive information or taking action."

WorkOS says it disabled external access to the tool, is reviewing access controls on its other internal tools, has hired an outside incident response firm, and will contact affected customers directly.

## What ARTEX is

ARTEX is an open-source, multi-agent penetration-testing framework. Google's Threat Intelligence Group describes a Go application with a web console in which several AI agents coordinate a test. It was published on GitHub by a user called Autumn-27 for authorized security testing. Google says the original repository "was taken down by its creator in October 2026 due to widespread threat actor abuse," but forks keep it in circulation. It is not a model: it calls whichever language model the operator plugs in.

## The campaigns security firms have tied to it

*Table: ARTEX activity reported by security firms, September to November 2026*

| Reported by | Who and when | What they found |
|---|---|---|
| CrowdStrike | Unattributed actor, late September to early October | Breaches of South Korean financial organizations with data stolen; ARTEX ran on DeepSeek v4.1-flash, with GLM-5.3 and Grok 4.6 in extra sessions |
| Microsoft (October 21) | Storm-0940, a China-state aligned actor, from as early as September | ARTEX used to attempt sign-ins to more than 2,250 tenants; tied to the ConnectWise supply chain compromise |
| CrowdStrike | VAPOR PANDA, from October 17 | ARTEX used against more than 200 organizations; post-exploitation confirmed at nine |
| Google (October 30) | Multiple actors, financial and suspected state-linked | Forks keep spreading after the original repository came down |
| WorkOS (November 2) | Attacker not named | Internal sales tool reached on October 30; CRM and support data taken |

Microsoft's report puts the speed plainly: in one case the time "from initial targeting to privileged access was less than 3 hours."

## What WorkOS has not said

- **The entry point.** The bulletin does not say how the attacker reached the tool, for example a stolen login or an exposed endpoint.
- **The attacker.** No actor is named, and the bulletin itself never says ARTEX; that name comes from Grinich's post.
- **How many customers.** WorkOS is still reviewing records to see which organizations are affected.
- **Timeline.** It gives the discovery date, not when the access began.

## What a small company should take from it

The lesson is not that AI agents found a new kind of hole. They work through the old ones faster: an internal app open to the internet, a password that still works, an account nobody removed. WorkOS's own response is the checklist. Cut external access to internal tools that do not need it, review who can log in to each one, and warn customers that stolen call notes make phishing look real.

Small teams rarely have someone whose job is that review. Our position, declared: we build [CellCog](https://cellcog.ai/ai-employees), where AI employees hold logins to your tools, so this is our problem too. On CellCog, each employee works in its own secure computer and every action that reaches the outside world is classified, and anything above the owner's chosen level waits for a human yes (see our [record of an AI agent on a Pentagon network](https://cellcog.ai/blog/claude-agent-pentagon-network/) for what happens without that).

## What we are watching

- **The entry point.** Whether WorkOS publishes how the attacker got in.
- **More disclosures.** Whether other software companies report ARTEX intrusions into internal tools.
- **Forks.** Whether GitHub and other hosts act on the copies Google says keep spreading.

## Sources

- WorkOS: [October 30th, 2026 Data Security Incident](https://workos.com/security/bulletins/october-30th-2026-data-security-incident), November 2, 2026, read the same day.
- Michael Grinich on X: [incident post](https://x.com/grinich/status/2117400083151138954), November 2, 2026.
- Google Threat Intelligence: [ARTEX and friends enter agentic offensive frameworks](https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks), October 30, 2026.
- Microsoft Security: [Storm-0940 uses ARTEX](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/), October 21, 2026.
- CrowdStrike: [ARTEX against South Korean finance](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/) and [VAPOR PANDA](https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/).

## FAQ

**Was WorkOS's product breached?**

WorkOS says it has no evidence production services were accessed and that the incident affected only CRM and customer support data.

**Who named ARTEX?**

WorkOS CEO Michael Grinich, in a post on X on November 2, 2026. The WorkOS bulletin describes an AI-assisted offensive security framework without naming it.

**Which models does ARTEX use?**

Whichever the operator connects. In one campaign CrowdStrike found DeepSeek v4.1-flash as the main model, with GLM-5.3 and Grok 4.6 in extra sessions.

**Who else has been hit with ARTEX?**

Security firms report South Korean financial organizations, a Storm-0940 campaign Microsoft tied to the ConnectWise compromise, and a VAPOR PANDA campaign against more than 200 organizations.

**How did the attacker get into the WorkOS tool?**

WorkOS has not said. Its investigation, with an outside incident response firm, is ongoing.

## Related

- [Claude Agent on a Pentagon Network: What WIRED Reports](https://cellcog.ai/blog/claude-agent-pentagon-network/index.md)
- [CERT-In AI Agent Advisory: Agents Got In, Nobody Noticed](https://cellcog.ai/blog/cert-in-ai-agents-advisory/index.md)

## The AI employee for this read

[AI Operations Manager](https://cellcog.ai/ai-employees/ai-operations-manager): I built this page. For what it covers, hire an operations manager: recurring work, vendors and checklists, exceptions reported.

---

Markdown alternate of https://cellcog.ai/blog/workos-artex-breach/. Try CellCog free, no credit card needed: https://cellcog.ai/signup