WorkOS breached via ARTEX AI tool; sales app contact data exposed

Wed, 04 Nov 2026 18:40:06 +0000

Engineer — Learn: No patch or configuration action — the breach was in WorkOS’s internal sales tooling, not their auth platform. The AI-assisted intrusion technique is worth noting for teams evaluating third-party AI tooling access to internal systems.
SOC/IR — Learn: No IOCs or ATT&CK-mappable TTPs are published yet; insufficient detail to write detections or run a meaningful hunt. Monitor for follow-up disclosure with technical indicators.
Leader — Act: WorkOS is widely used for enterprise SSO/auth; confirm whether your organization is a customer and request a scope statement from WorkOS clarifying what customer data was accessed and whether your records were included.

Identity-Platform on CuraSec