WorkOS reports security breach in GTM systems
Original title: WorkOS reports security breach
Attack from ARTEX AI framework accessed Salesforce and Snowflake, exposing business contact data.
On October 30, 2026, WorkOS detected anomalous traffic in an internal business system. The attack was driven by ARTEX, an AI-assisted autonomous penetration testing framework, originating from IP addresses in Hong Kong and China. It gained access to an internal API for sales and marketing tools, reaching Salesforce and Snowflake instances. The accessed data includes business contact information, account details, aggregated product usage metrics, marketing contacts, and support tickets for WorkOS customers. No evidence of customer application data access or production service impact. The incident is contained to CRM and customer support data. WorkOS is investigating with independent experts.
Unconfirmed: No evidence that customer application data was accessed
- Attack tool: ARTEX AI-assisted penetration testing framework
- Attack origin: IP addresses in Hong Kong and China
- Affected systems: Salesforce and Snowflake instances
- Data types: business contacts, emails, addresses, support tickets
- No customer application data accessed
Impact: customer business contact information exposed
- Vendors
- WorkOS
- Products
- SalesforceSnowflake
- Threat actors
- ARTEX
- Victims
- WorkOS customers
From the original article
2 min read at news.ycombinator.com[](https://news. ycombinator. com/)Hacker Newsnew past comments ask show jobs submitlogin [](https://news.
By werrett · news.ycombinator.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.