What happened. WorkOS, which sells login and single sign-on plumbing to software companies, says it found unauthorized access to an internal application used by its sales team on Oct 30, 2026. It disabled outside access to that app, reviewed access controls on its internal tools and hired an outside forensics firm.
What was taken. Business contact details from its CRM (names, emails, job titles, companies), customer account histories (product usage and connection or directory health), summaries and excerpts of sales calls, support discussions and customer Slack conversations, and sales relationship notes. WorkOS says no WorkOS app data or production services were accessed. How many customers or records: Undisclosed.
The AI angle. Founder Michael Grinich says the attacker used ARTEX, an AI penetration-testing suite that automates scouting and break-in attempts and has shown up in multiple incidents this year. That makes it the second vendor this week, after Chainalysis, to blame an AI-driven intrusion.
Why this matters to an enterprise. Call notes and Slack excerpts tell a phisher exactly what your team discussed with a vendor, so fake follow-ups can sound real. If you are a WorkOS customer, warn the people who talk to its sales and support teams, and verify any request about SSO or directory settings through a known channel. Internal sales tools rarely get production-grade security, and AI tooling makes probing them cheap.