WorkOS Says an Attacker Used an AI Hacking Tool to Breach an Internal Sales App

WorkOS, a company that provides login and identity tools for software businesses, has disclosed a security incident in which an attacker accessed one of its internal applications.

What happened

• On October 30, 2026, an attacker accessed an internal sales application.
• Exposed data included business contact details and summaries of customer communications.
• WorkOS said no production services or customer application data were affected.
• Founder Michael Grinich attributed the intrusion to ARTEX, an open-source AI penetration-testing framework — software built to help security teams test their own defences, which in this case was used by an attacker.

The response

WorkOS said it disabled external access to the affected application and hired an outside forensics firm to investigate. The company has more than 3,000 customers.

Why it matters

Security researchers have long warned that AI tools built for defenders can also help attackers move faster. This incident is one of the first public cases in which a company has directly linked a breach to an AI penetration-testing framework.

For businesses, the lesson is familiar: internal tools such as sales and support systems often hold sensitive information but receive less security attention than customer-facing products. Limiting who can reach them from the internet, requiring strong authentication and monitoring unusual access all reduce the risk.

Sources

• WorkOS security bulletin: October 30th, 2026 data security incident
• BleepingComputer: WorkOS says attacker used ARTEX AI to breach internal sales app