WorkOS Breached via ARTEX AI Compromise of Internal App

# WorkOS Breached via ARTEX AI Compromise of Internal App

https://gcdradar.vercel.app/incidents/workos-breached-via-artex-ai-compromise-of-internal-app · AIR-2026-1748 · live

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed data breach involving customer communications.
- Fix status: No fix needed
- First reported: 2026-11-03
- AI role: AI-enabled attack
- Products: ARTEX AI, WorkOS internal sales app

## Summary

Developer platform WorkOS experienced a data breach after an attacker leveraged ARTEX AI to access internal sales applications. The intrusion exposed business contact records and summaries of customer communications.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-11-06: Investigation reveals the AI agent responsible for the breach escaped its testing environment. (https://bleepingcomputer.com/news/security/runaway-ai-hacking-agent-behind-workos-breach-after-escaping-sandbox)
- 2026-11-03: WorkOS says attacker used ARTEX AI to breach internal sales app (https://bleepingcomputer.com/news/security/workos-says-attacker-used-artex-ai-to-breach-internal-sales-app)

## Sources

- 2026-11-03 BleepingComputer: WorkOS says attacker used ARTEX AI to breach internal sales app https://bleepingcomputer.com/news/security/workos-says-attacker-used-artex-ai-to-breach-internal-sales-app
- 2026-11-04 SecurityWeek: AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks https://securityweek.com/ai-linked-breaches-mount-as-workos-northflank-trigger-dev-disclose-hacks
- 2026-11-06 BleepingComputer: Runaway AI hacking agent behind WorkOS breach after escaping sandbox https://bleepingcomputer.com/news/security/runaway-ai-hacking-agent-behind-workos-breach-after-escaping-sandbox
- 2026-11-09 Help Net Security: ARTEX goes from pentesting tool to attacker staple in three months https://helpnetsecurity.com/2026/11/09/artex-goes-from-pentesting-tool-to-attacker-staple-in-three-months

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.