WorkOS Security Incident Report October 2026

Incident Overview

On October 30, 2026, WorkOS identified a security incident involving unauthorized access to its internal business systems. The breach was traced to anomalous traffic detected at 16:39 UTC, which the company attributes to an AI-assisted, autonomous penetration testing framework known as ARTEX. The attack originated from IP addresses located in Hong Kong and China.

Scope of Impact

The unauthorized access was limited to internal APIs connected to the company's sales and marketing infrastructure. Data exposed during the incident includes information stored within Salesforce and Snowflake instances, specifically:

  • Business contact information (names, email addresses, phone numbers)
  • Company mailing addresses
  • Aggregated and de-identified product usage metrics
  • Marketing contact lists
  • Support tickets

WorkOS has stated that there is no evidence that customer application data, production services, or core platform infrastructure were accessed or compromised during this event.

Company Response and Mitigation

WorkOS CEO Michael Grinich confirmed the incident, emphasizing that the breach was isolated to internal go-to-market (GTM) systems. The company has contained the unauthorized access and engaged independent security experts to conduct a forensic investigation. WorkOS has published an official security bulletin and is offering direct consultations with their security team for affected customers via their security email address.

Community Discussion and Perspectives

Industry observers and users on Hacker News have debated the implications of the breach notification. Some users expressed skepticism regarding the company's ability to definitively rule out access to specific data sets, given the nature of automated, AI-driven attacks.

"We have no evidence that your application data was accessed. Translation: We don't know how we were hacked and can't tell what anyone did or didn't look at. In that case I would treat it as full compromise and urge everyone who might be potentially affected to change password, rotate keys, whatever you need to do to protect yourself." — majorchord

In response to these concerns, the company maintains that its production environment remains secure and that the incident was strictly localized to the CRM and customer support data layers.

Sources