Vendor incident, severity medium

WorkOS internal sales app breached; customer contacts and communication summaries accessed

Published November 3, 2026

WorkOS identified unauthorized access on October 30, 2026 to an internal application used by its sales team. The attacker, who used the ARTEX AI offensive security framework, accessed business contact details, customer account histories and summaries or excerpts of customer communications. WorkOS says no WorkOS app data or production services were accessed, and it has contained the incident.

What's affected

• workosevery version

What to do

1. Watch for phishing or social engineering attempts that use WorkOS-related contact details or communication content.
2. Wait for WorkOS to notify affected customers directly and follow its guidance.

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident workos-sales-app-breach-2026-10

References

• https://www.bleepingcomputer.com/news/security/workos-says-attacker-used-artex-ai-to-breach-internal-sales-app/

Notice workos-sales-app-breach-2026-10, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.