WorkOS disclosed that an attacker accessed an internal sales application on October 30, 2026, using the ARTEX AI penetration testing suite to automate reconnaissance and exploitation. The breach exposed business contact details, customer account histories, and summaries of sales calls, support discussions, and Slack conversations. No WorkOS app data or production services were compromised, and the company disabled external access to the affected app, reviewed internal access controls, and hired an independent forensics firm. Founder Michael Grinich said the attacker’s web requests included user agents ‘artex-enrich/1.0’ and ‘norma/0.4.’ ARTEX AI, released earlier this year by Chinese developers and later privatized after attacks on South Korean banks, remains available through open-source forks and has been linked to other incidents, including a campaign by the “Vapor Panda” group. 1