WorkOS, the company behind login and single sign-on tools such as AuthKit, has disclosed that attackers got into an internal application used by its sales team. The company noticed the access on 30 October and published its notice on 2 November.
If you do business with WorkOS, the practical risk is phishing. The exposed material includes summaries of real sales and support conversations, so a fake message that mentions a genuine colleague or ticket can look convincing. WorkOS tells customers to confirm any unexpected request before acting, even one that mentions a real colleague or ticket.
What the sales app held
According to the WorkOS security bulletin, the application gave access to four kinds of information:
- Contact records from its CRM: who people are, how to reach them, their roles and employers.
- Account histories and notes about customer relationships.
- Notes and excerpts from sales calls, support threads and Slack channels shared with customers.
- Usage data, such as how customers use WorkOS products and the health of their connections and directories.
The bulletin describes these as the categories the app could reach, and WorkOS is still going through the records to see which organisations were affected. It says it will contact affected customers directly.
An AI-assisted attack tool
WorkOS says the intruders used an AI-assisted offensive security framework to automate probing and exploitation. The bulletin does not name the tool. Cyber Security News reported that founder and CEO Michael Grinich named it as ARTEX in a post on X,.
The company points to recent research from Wiz, Google and CrowdStrike on attackers using AI agents that pick their next step based on how a target responds. It argues that this makes weak spots such as exposed applications and stolen credentials more dangerous, because attacks move faster. The bulletin does not say how the attackers first got in.
What WorkOS has done
Outside access to the app has been switched off, and the company is auditing who can reach its other internal tools. An outside forensics and incident response firm has been brought in to work out how far the intruders got.
WorkOS adds that nothing so far shows its own application data or live services were touched. The investigation so far points only to CRM and customer support information.
The investigation is still running, and WorkOS says it will post further updates as it verifies more details. Customers who have not heard from the company directly should watch the bulletin page for changes.
