---
title: WorkOS says an AI-assisted attack framework got into an internal sales tool on Oct 30, exposing CRM data and excerpts of customer Slack and support conversations; its CEO says the user agents point to ARTEX | ctxsec
url: https://ctxsec.com/items/workos-oct-30-internal-sales-tool-breach-ai-attack-framework-artex-user-agents
description: "WorkOS, which sells SSO and directory sync to SaaS companies, published a bulletin on Nov 2 saying it found unauthorized access on Oct 30 to an internal application its sales team uses. The data exposed includes business contact details, account histories, summaries and excerpts of sales calls, support discussions and customer Slack conversations, and product-usage metadata. WorkOS says it has no evidence that production services or customer application data were touched. Its bulletin says the attacker used an AI-assisted offensive framework to automate reconnaissance and exploitation; CEO Michael Grinich said on X that WorkOS saw user agents artex-enrich/1.0 and norma/0.4, which it believes are likely ARTEX, the framework Wiz, Google and CrowdStrike have tied to recent intrusions."
status: "official (WorkOS security bulletin, Nov 2; CEO Michael Grinich on X, Nov 2-3). ARTEX link is WorkOS's own 'likely' assessment from user-agent strings; no actor named"
published: 2026-11-02
---

> WorkOS, which sells SSO and directory sync to SaaS companies, published a bulletin on Nov 2 saying it found unauthorized access on Oct 30 to an internal application its sales team uses. The data exposed includes business contact details, account histories, summaries and excerpts of sales calls, support discussions and customer Slack conversations, and product-usage metadata. WorkOS says it has no evidence that production services or customer application data were touched. Its bulletin says the attacker used an AI-assisted offensive framework to automate reconnaissance and exploitation; CEO Michael Grinich said on X that WorkOS saw user agents artex-enrich/1.0 and norma/0.4, which it believes are likely ARTEX, the framework Wiz, Google and CrowdStrike have tied to recent intrusions.

[← Cybersecurity News](/news) · [markdown](/items/workos-oct-30-internal-sales-tool-breach-ai-attack-framework-artex-user-agents.md)

official (WorkOS security bulletin, Nov 2; CEO Michael Grinich on X, Nov 2-3). ARTEX link is WorkOS's own 'likely' assessment from user-agent strings; no actor named

2026-11-02

### WorkOS says an AI-assisted attack framework got into an internal sales tool on Oct 30, exposing CRM data and excerpts of customer Slack and support conversations; its CEO says the user agents point to ARTEX

- **Confirmed by WorkOS:** unauthorized access found Oct 30 to an internal sales application; data involved covers CRM contact details (names, emails, phones, titles, companies), account and relationship history, summaries and excerpts of sales calls, support threads and customer Slack conversations, and product-usage and directory-health metadata. External access to the app is disabled, an outside DFIR firm is engaged, and affected customers will be contacted directly.
- **Not affected, per WorkOS:** no evidence that WorkOS application data or production services were accessed.
- **Tooling:** the bulletin says an AI-assisted offensive security framework automated recon and exploitation. Grinich said on X that requests carried user agents `artex-enrich/1.0` and `norma/0.4`, "likely attributable to ARTEX" based on Wiz reporting and forks of the open-source tool. He also said tokens pasted into support messages are revoked immediately.

**What to do if you're a WorkOS customer:** expect convincing phishing that quotes real sales or support conversations, and verify any unexpected request out of band; rotate any secret that was ever pasted into a WorkOS support or shared Slack thread; and search your own web and API logs for the two user-agent strings above. More broadly, give sales and support tools that can read customer Slack or ticket history the same access review as production.

Sources: [WorkOS: October 30th, 2026 Data Security Incident (Nov 2)](https://workos.com/security/bulletins/october-30th-2026-data-security-incident) · [Michael Grinich on X: incident context (Nov 2)](https://x.com/grinich/status/2117400083151138954) · [Michael Grinich on X: artex-enrich/1.0 and norma/0.4 user agents](https://x.com/grinich/status/2117453251016872236)