{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "WorkOS says an AI-driven attacker breached its internal sales tool and accessed CRM and customer-conversation data · updates",
  "home_page_url": "https://pwn.watch/i/workos-internal-sales-app-breach-artex-oct-2026",
  "feed_url": "https://pwn.watch/i/workos-internal-sales-app-breach-artex-oct-2026/feed.json",
  "description": "WorkOS, the developer platform that provides enterprise SSO, user management and directory sync APIs to thousands of companies, says it identified unauthorized access to an internal application used by its sales team on Oct 30 2026. In a Nov 2 bulletin it says the attacker accessed business contact details (names, emails, phone numbers, job titles, companies) from its CRM, account and relationship histories, summaries and excerpts from sales calls, support discussions and customer Slack conversations, and operational metadata about customers' product usage and connection or directory health. WorkOS says there is no evidence that WorkOS application data or production services were accessed, and that the attacker used an AI-assisted offensive security framework to automate reconnaissance and exploitation; CEO Michael Grinich later named it as the ARTEX AI framework. WorkOS disabled external access to the app, hired an outside forensics firm and is notifying affected customers directly. Customers have nothing to patch, but should expect targeted phishing that uses the exposed contact and conversation details.",
  "language": "en",
  "_pwn": {
    "slug": "workos-internal-sales-app-breach-artex-oct-2026",
    "severity": "medium",
    "status": "live",
    "patchStatus": "partial",
    "rss": "https://pwn.watch/i/workos-internal-sales-app-breach-artex-oct-2026/feed.xml",
    "llms": "https://pwn.watch/i/workos-internal-sales-app-breach-artex-oct-2026/llms.txt",
    "json": "https://pwn.watch/i/workos-internal-sales-app-breach-artex-oct-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/workos-internal-sales-app-breach-artex-oct-2026#2026-11-03-1b86b151",
      "url": "https://pwn.watch/i/workos-internal-sales-app-breach-artex-oct-2026#2026-11-03-1b86b151",
      "title": "WorkOS says an AI-driven attacker breached its internal sales tool and accessed CRM and customer-conversation data: BleepingComputer reports Grinich named the ARTEX AI penetration-testing suite, with attacker user agents such as artex-enrich/1.0 and norma/0.4, and that WorkOS will share more after its investigation.",
      "content_text": "WorkOS says an AI-driven attacker breached its internal sales tool and accessed CRM and customer-conversation data: BleepingComputer reports Grinich named the ARTEX AI penetration-testing suite, with attacker user agents such as artex-enrich/1.0 and norma/0.4, and that WorkOS will share more after its investigation.\n\nSource: https://www.bleepingcomputer.com/news/security/workos-says-attacker-used-artex-ai-to-breach-internal-sales-app/",
      "date_published": "2026-11-03T00:00:00.000Z",
      "external_url": "https://www.bleepingcomputer.com/news/security/workos-says-attacker-used-artex-ai-to-breach-internal-sales-app/",
      "tags": [
        "medium"
      ]
    },
    {
      "id": "https://pwn.watch/i/workos-internal-sales-app-breach-artex-oct-2026#2026-11-02-585470e2",
      "url": "https://pwn.watch/i/workos-internal-sales-app-breach-artex-oct-2026#2026-11-02-585470e2",
      "title": "WorkOS says an AI-driven attacker breached its internal sales tool and accessed CRM and customer-conversation data: WorkOS publishes a security bulletin listing the data involved (CRM contacts, account histories, sales call and support summaries, customer Slack excerpts, product usage metadata), says it found no evidence application data or production services were touched, and says an AI-assisted offensive security framework automated the attack..",
      "content_text": "WorkOS says an AI-driven attacker breached its internal sales tool and accessed CRM and customer-conversation data: WorkOS publishes a security bulletin listing the data involved (CRM contacts, account histories, sales call and support summaries, customer Slack excerpts, product usage metadata), says it found no evidence application data or production services were touched, and says an AI-assisted offensive security framework automated the attack..\n\nSource: https://workos.com/security/bulletins/october-30th-2026-data-security-incident",
      "date_published": "2026-11-02T00:00:00.000Z",
      "external_url": "https://workos.com/security/bulletins/october-30th-2026-data-security-incident",
      "tags": [
        "medium"
      ]
    },
    {
      "id": "https://pwn.watch/i/workos-internal-sales-app-breach-artex-oct-2026#2026-10-30-358c6d09",
      "url": "https://pwn.watch/i/workos-internal-sales-app-breach-artex-oct-2026#2026-10-30-358c6d09",
      "title": "WorkOS says an AI-driven attacker breached its internal sales tool and accessed CRM and customer-conversation data: WorkOS identifies unauthorized access to an internal application used by its sales team and disables external access to it.",
      "content_text": "WorkOS says an AI-driven attacker breached its internal sales tool and accessed CRM and customer-conversation data: WorkOS identifies unauthorized access to an internal application used by its sales team and disables external access to it.\n\nSource: https://workos.com/security/bulletins/october-30th-2026-data-security-incident",
      "date_published": "2026-10-30T00:00:00.000Z",
      "external_url": "https://workos.com/security/bulletins/october-30th-2026-data-security-incident",
      "tags": [
        "medium"
      ]
    }
  ]
}