WorkOS reports unauthorized internal API access affecting business data
What happened
WorkOS told customers about a security incident, according to a November 3 report. The notice says the company detected anomalous traffic on October 30, 2026 at 16:39 UTC, and that unauthorized visitors reached business data in Salesforce and Snowflake through an internal API. The data includes customer contact details, account and commercial information, aggregated and de-identified product usage metrics, and customer support tickets. The notice also says the attack may have been driven by ARTEX, an AI-assisted autonomous penetration testing framework. That link is stated as a possibility, and the report does not confirm ARTEX took part.
Written by AI from the coverage · updated 2 hours ago
Coverage
Follow the reports to see the story from different sides.
- Hacker News front pageWorkOS reports security breach
WorkOS 向客户通报安全事件，未授权访问者通过内部 API 获取了 Salesforce 和 Snowflake 中的业务数据。通知称，WorkOS 于 October 30, 2026 的 16:39 UTC 检测到异常流量，攻击可能由 AI 辅助的自主渗透测试框架 ARTEX 驱动，涉及客户联系方式、账户及商业信息、汇总且去标识化的产品使用指标和支持工单。
Heat over time
Not enough continuous observations to draw a trend yet.