WorkOS: ARTEX AI read the sales CRM

WorkOS, the developer platform that sells APIs for enterprise login, single sign-on, and user directories, says it found unauthorized access to an internal sales application on October 30, 2026. The company says the intruder used an AI offensive-security framework to automate reconnaissance. Founder Michael Grinich later named the suite: ARTEX, a penetration-testing framework already tied to other incidents this year.

The material in scope is sales material. WorkOS says the intruder could read business contacts from its CRM — names, email addresses, job titles, and the companies those people work for — plus account histories that include product usage and the health of connections and directories. Summaries and excerpts from sales calls, support discussions, and customer Slack conversations were in the same set, along with notes on the business relationship.

WorkOS says the investigation found customer application data and production services outside the intrusion. The identity traffic the company carries for tenants sits in a different system from the sales app that was opened. That line belongs in the customer brief. A follow-up message will try to blur it.

The company says at least 3,000 firms use the platform. Its public customer list includes OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, and Netlify. Those names are customers of the product. The notice covers sales records about relationships with customers. It leaves production tenants out of the accessed set. A note that quotes a real onboarding call is still enough to impersonate WorkOS, or to impersonate the customer back to WorkOS.

What the company did

After detection, WorkOS cut external access to the affected application and reviewed who could open internal tools. It hired an outside forensics firm. Grinich says the incident is contained and that more will be published when the investigation allows. Affected customers are to be notified directly. Everyone else is told to watch for phishing and social engineering that uses the exposed information.

The investigative team, Grinich said, saw the user agents artex-enrich/1.0 and norma/0.4 on the intruder’s requests. ARTEX began as an open-source project from developers in China. The makers later took it private after it was used against banks in South Korea. Forks that were already public stayed in circulation. CrowdStrike has described a separate campaign, tracked as Vapor Panda, that aimed the same framework at a large set of organizations. The Dutch Institute for Vulnerability Disclosure has also attributed a September intrusion on its own network to ARTEX. The WorkOS case is a victim disclosure. The user agents are the link the company has put on the record. This briefing will not describe the framework’s methods.

What customers and peers should do

If WorkOS notifies your company, assume a real name, a real usage figure, and a real sentence from a call can show up in a pretext this month. Brief sales, support, and anyone who sits in a customer channel. Verify on a second channel before anyone changes a directory integration, adds an administrator, or moves a deal on the strength of a message that sounds familiar.

An internal sales or success tool is a directory of who trusts the company. Give it the same access review as an admin console. An account that can read every call summary from outside the office is a standing export. Close that path before an agent framework asks for it. WorkOS says it closed external access after the fact. The useful copy of that decision is the one made beforehand.

On the wire, those two user-agent strings are a hunt. A burst of requests labeled artex-enrich or norma against a CRM, a support desk, or an internal admin host is an incident even when the login succeeds. Log the user agent. Alert on those names.

The production identity stack stayed outside this intrusion. The exposure is the conversation around it. The person who can approve a single sign-on change still reads mail, and the mail now has better source material.

This briefing relies on public reporting by BleepingComputer and on WorkOS’s incident alert. It does not include exploit procedures.