Observed incident

AI-assisted attack exposes WorkOS sales and support information

Reported

Published here

What happened

WorkOS found unauthorized access to an internal application used by sales and customer-facing teams on October 30. Exposed records included business contacts, communications and operational customer metadata. The company attributes the attack to an AI-assisted offensive framework.

Parties and reporting

AI tools and systems: AI-assisted offensive security framework, ARTEX (CEO attribution), Internal sales and support systems

Outcome

External access was disabled and independent investigators engaged. WorkOS reports no evidence of production-service or application-data access; record-level review continues and the company says it will contact affected customers.

Operating lesson

Restrict internal business tools, audit their access and prepare customers for phishing based on exposed support context.

Evidence and limits

November 2 is the bulletin date, not the October 30 discovery date. The CEO identified ARTEX in a subsequent public reply; the bulletin does not name it. Customer-posted backend details and network-origin attribution remain unverified and are omitted.

Sources