Agent chaosVerified·4 Nov 2026
An AI-assisted attack framework broke into WorkOS's internal sales tool and reached CRM data and customer Slack excerpts
Developer platform WorkOS says an attacker used an AI-assisted offensive security framework to automate reconnaissance and exploitation and got into an internal sales tool on 30 October. CRM contacts, account histories and excerpts of sales calls, support chats and customer Slack conversations were exposed; WorkOS says production was untouched.
WorkOS, which sells login and identity tools to thousands of software companies, says an attacker broke into an internal app used by its sales and customer-facing teams. It found the unauthorised access on 30 October 2026 and published a security bulletin on 2 November.
What happened
WorkOS says its investigation found the attacker used an AI-assisted offensive security framework to automate reconnaissance and exploitation attempts. In other words, much of the probing and break-in work was done by software that picks its next move from the target's responses.
The company's founder, Michael Grinich, said the requests carried user agents such as 'artex-enrich/1.0' and 'norma/0.4', pointing to the ARTEX AI penetration-testing suite, a tool that has turned up in other attacks this year.
What was exposed
WorkOS lists four kinds of data the affected app gave access to:
Business contact details from its CRM (names, email addresses, phone numbers, job titles and companies); customer account histories and sales-relationship information; summaries and excerpts from sales calls, support discussions and customer Slack conversations; and operational metadata about how customers use WorkOS products, including connection and directory health.
WorkOS says there is no evidence that WorkOS application data or production services were accessed or affected, and that the incident appears limited to CRM and customer support data.
What WorkOS did
It shut off external access to the affected app, started a broader review of access controls on internal tools and hired an independent digital forensics and incident response firm. It says it will contact affected customers directly, and it warned customers to watch for phishing and social engineering that uses the leaked details. Its founder says the incident is contained.
Why it matters
In the bulletin, WorkOS points to recent reports from Wiz, Google and CrowdStrike on attackers using AI agents in real intrusions, and says these tools speed up attacks on exposed apps and stolen credentials.
Our take
This is our opinion. A list of customer contacts plus what they said to support is a ready-made phishing kit. Internal sales and support tools rarely get the hardening production gets, yet they hold the most useful data for the next attack: who to email, what they use, what they complained about. If an AI agent can grind on an exposed internal app all night, put those apps behind your single sign-on and a VPN or zero-trust proxy, and alert on bulk reads.
Your internal tools are someone's attack surface: keep them off the open internet and watch for bulk exports, because automated attackers don't get bored.
