Act
active
WorkOS breached via ARTEX AI tool; sales app contact data exposed
- Engineer — Learn: No patch or configuration action — the breach was in WorkOS’s internal sales tooling, not their auth platform. The AI-assisted intrusion technique is worth noting for teams evaluating third-party AI tooling access to internal systems.
- SOC/IR — Learn: No IOCs or ATT&CK-mappable TTPs are published yet; insufficient detail to write detections or run a meaningful hunt. Monitor for follow-up disclosure with technical indicators.
- Leader — Act: WorkOS is widely used for enterprise SSO/auth; confirm whether your organization is a customer and request a scope statement from WorkOS clarifying what customer data was accessed and whether your records were included.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.