Hi everyone - WorkOS CEO here.

WorkOS's production systems are secure. No customer platform data was accessed. This incident was isolated to internal GTM systems.

The attack involved ARTEX, an autonomous AI agent framework used to carry out offensive security operations. It's a striking example of how quickly the capabilities of attackers are evolving.

We've contained the incident, brought in independent experts to investigate, and are working through the details.

Security is something we take extremely seriously, and I believe in being transparent when things go wrong. We'll continue to share updates as we learn more.

Here’s the full post: https://workos.com/security/bulletins/october-30th-2026-data...

If you are a customer and would like to have a call with our security team, please send a note to security@workos.com

▲

minimaltom a day ago | parent | next [-]

Thanks for being so transparent.

Is it understood what the initial attack vector was? How confident are you that compromise is contained to just this GTM application (and lateral movement/exposure hasnt occurred)?

	▲	grinich 2 hours ago \| parent [-]
		We identified and verified the attack vector and have no indication there is other compromise. In addition to our in-house security team, we also have hired a 3rd-party firm to do their own investigation and validate our analysis. We hope to share more about our findings once the investigation concludes.

▲

barrrrald 21 hours ago | parent | prev | next [-]

Thanks for the transparency

▲

_pdp_ 21 hours ago | parent | prev [-]

> The attack involved ARTEX

Why does it matter what framework is used?

▲

Cordiali 19 hours ago | parent [-]

It may not be relevant from your perspective, but yours isn't the only one. Others will find this detail useful or insightful, for any number of reasons.

So, why? Because details matter.

▲

_pdp_ 13 hours ago | parent [-]

It is as useful as saying that attackers used Kali Linux - no details of what was actually exploited, just blaming some random tool.

	▲	NeckBeardPrince 13 hours ago \| parent [-]
		They aren’t blaming a random tool, where do you see blame? For you this information may not be relevant but for many people in the cybersecurity sector it’s very relevant and helps put these frameworks into the spotlight. Sharing knowledge is not a bad thing.