# SZB-b191afc8db: WorkOS says attacker accessed contact records and customer communication summaries

BleepingComputer reports that developer platform WorkOS suffered a data breach in which a threat actor accessed business contact records and summaries of customer communications.

- Type: Breach
- Status: Reported, not confirmed
- Vendor: WorkOS
- Product: internal sales app
- Disclosed: 2026-11-02 23:30 UTC
- Data taken: Names, Email addresses
- Sources: 10 distinct
- First seen by cve.now: 2026-11-02 23:32 UTC · Updated: 2026-11-04 01:10 UTC

> No statement or filing from WorkOS has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## Summary

The headline attributes the intrusion to an attacker using ARTEX AI against an internal sales app, but the item's text does not confirm that detail.

## What to do

- Expect phishing that uses this breach; verify messages that mention it · For email addresses
- Check WorkOS's official status page and customer notices for confirmed scope and affected data
- Rotate WorkOS API keys and client secrets as a precaution
- Review integrations and audit logs for unusual WorkOS access

## Timeline

- 2026-10-30: Discovered. BleepingComputer: ““On October 30, 2026, we identified unauthorized access to an internal WorkOS application used by our sales team,” the company says in an incident alert .” ([source](https://www.bleepingcomputer.com/news/security/workos-says-attacker-used-artex-ai-to-breach-internal-sales-app/))
- 2026-11-02 23:30 UTC: Made public by BleepingComputer
- 2026-11-02 23:32 UTC: First seen by cve.now
- 2026-11-04 01:10 UTC: Record last updated

## What was taken

- Names, Email addresses: [BleepingComputer](https://www.bleepingcomputer.com/news/security/workos-says-attacker-used-artex-ai-to-breach-internal-sales-app/): “Business contact details (names, email addresses, job titles, and company affiliations from the CRM systems)”

## Evidence (10 sources)

- 2026-11-02 · Social · [Hacker News](https://news.ycombinator.com/item?id=50345712): “WorkOS reports security breach”
- 2026-11-03 · Social · [Bluesky](https://bsky.app/profile/infosec.skyfleet.blue/post/53eo23tkquhlx): “Hackers Use ARTEX AI to Breach WorkOS and Access Customer Slack Conversations” (+2 more: [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzfsno4x5n26), [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzh5v2wykx2s))
- 2026-11-03 · Social · [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzf6msdrnm2d): “WorkOS has disclosed a security incident involving unauthorized access to an internal application used by its sales team,…” (+2 more: [Bluesky](https://bsky.app/profile/gazewires.bsky.social/post/3mzgshonuqp25), [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzgsupneyc2w))
- 2026-11-03 · Social · [Bluesky](https://bsky.app/profile/timkellogg.me/post/3mzfu6f24rs2f): “WorkOS says they were breached by an attacker using ARTEX, an AI-assisted cyber offensive framework”
- 2026-11-03 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/workos-says-attacker-used-artex-ai-to-breach-internal-sales-app/): “Developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications.” (+1 more: [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3mzgrujuoxq2r))
- 2026-11-03 · Social · [Bluesky](https://bsky.app/profile/cybernewsph.com/post/3mzgskzbkec22): “Developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications”, BleepingComputer reports.”
- 2026-11-03 · Social · [Mastodon](https://infosec.exchange/@cloud/117554687818685697): “Contact records exposed, no production services hit.”
- 2026-11-03 · Social · [Bluesky](https://bsky.app/profile/infosec.skyfleet.blue/post/76cnw7qql4vvs): “WorkOS says attacker used ARTEX AI to breach internal sales app” (+2 more: [Bluesky](https://bsky.app/profile/hapsis.bsky.social/post/3mzgw27sqzs26), [Bluesky](https://bsky.app/profile/ninjaowl.ai/post/3mzh2cd3ufo2m))
- 2026-11-04 · Social · [Mastodon](https://infosec.exchange/@DevaOnBreaches/117555451432964939): “WorkOS confirms a # databreach after hackers reportedly used the ARTEX AI offensive security framework to automate attacks.”
- 2026-11-04 · Social · [Bluesky](https://bsky.app/profile/thehotdrop.live/post/3mzh5njeq4u2m): “Attackers breached a WorkOS internal sales app, exposing customer contact info and business conversations.”

## Corrections

- 2026-11-03: Removed “WorkOS says the breach happened”: its source no longer supports it.
- 2026-11-04: Removed “WorkOS says the breach happened”: its source no longer supports it.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-b191afc8db&body=https%3A%2F%2Fcve.now%2FSZB-b191afc8db%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about the WorkOS breach

### Was WorkOS breached?

BleepingComputer reports it. No statement from WorkOS has reached cve.now yet.

### What data was exposed?

Names, Email addresses.

### What should WorkOS customers do?

Expect phishing that uses this breach; verify messages that mention it. Check WorkOS's official status page and customer notices for confirmed scope and affected data. Rotate WorkOS API keys and client secrets as a precaution. Review integrations and audit logs for unusual WorkOS access.

## Related

- Started as early warning SZB-b191afc8db, first seen 2026-11-02 23:32 UTC
- Browse: [Breaches](https://cve.now/breaches.md) · [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-b191afc8db
Site guide for agents: https://cve.now/llms.txt