Skip to content
NewA calmer, faster ZeroHour
StoryData breachhighExploited in the wild

WorkOS Breach via ARTEX AI Exposes Salesforce Data

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

WorkOS detected ARTEX AI-driven breach on October 30, 2026, exposing customer data in Salesforce and Snowflake with no production impact.

On October 30, 2026, WorkOS detected anomalous traffic in its internal sales application using the ARTEX AI-assisted penetration testing framework originating from Hong Kong and China. The attack accessed Salesforce and Snowflake instances, revealing business contact information, emails, addresses, support tickets, customer account histories, and Slack conversation excerpts. No customer application data or production services were impacted. WorkOS disabled access, engaged independent experts, and plans to contact customers directly. A security bulletin was published on November 2.

Key facts
  • ARTEX AI framework used in breach
  • Accessed Salesforce and Snowflake
  • Exposed business contacts and Slack data
  • No production services impacted
  • Detected October 30, 2026
  • Bulletin published November 2, 2026
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 30, 2026WorkOS detects ARTEX AI breach · Hacker News
  2. Nov 2, 2026WorkOS publishes security bulletin · Cyber Security News

What each outlet adds

beyond the shared facts
  • Hacker NewsARTEX origins in Hong Kong and China, aggregated product usage metrics
  • Cyber Security NewsCustomer Slack conversations exposed, independent forensics engaged, direct customer contact planned
Vendors
WorkOS
Products
internal sales applicationSalesforceSnowflake
Threat actors
ARTEX
Victims
customersWorkOS customers
Organizations
Google Threat Intelligence GroupMandiantWiz
Countries
Hong KongChina

Coverage

oldest first · one row per article · UTC
  1. · 5h ago Hacker News · securityFirst report

    WorkOS reports security breach in GTM systems

    Attack from ARTEX AI framework accessed Salesforce and Snowflake, exposing business contact data.

  2. · 1h ago Cyber Security News

    WorkOS confirms data breach exposing customer Slack conversations

    WorkOS detected unauthorized access to an internal sales app on October 30, 2026, with no evidence of production service impact.