INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

WorkOS breached via ARTEX AI

| 2026-11-03 21:28 HIGH LOW AI-ENABLED ATTACK · AUTONOMOUS DATA BREACH
JSON
Executive Summary
AI-generated
On November 3, 2026, developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications. The attacker used an AI-powered offensive security framework to automate reconnaissance and exploitation attempts, specifically ARTEX AI penetration testing suite, which was observed in multiple incidents this year. At least 3,000 companies use WorkOS services, including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, Webglow, and Netlify. The company notified affected customers directly and warned its users to remain vigilant for phishing or social engineering attempts leveraging the exposed information after detecting unauthorized access to an internal application used by their sales team on October 30, 2026.
Technical Mitigations AI-generated
• Block or hunt for 'artex-enrich/1.0' and 'norma/0.4' user agents in web requests. • Use Adaptive Security's AI agents to analyze email intent, context, and behavior to uncover phishing attempts leveraging exposed information from the breach. • Monitor for signs of ARTEX AI penetration testing suite usage, such as 'artex-enrich/1.0' and 'norma/0.4', in web requests or system logs. • Implement a 14-day read-only scan of Microsoft 365 or Google Workspace to detect potential phishing attempts leveraging exposed information from the breach.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
CN KR
Incident Timeline
‎October 30, 2026
Threat actors used ARTEX AI to breach internal WorkOS sales app.
organisation Adaptive Security's
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
organisation CrowdStrike
More recently, CrowdStrike revealed that cyber-espionage group “Vapor Panda” used the pentesting framework in a global campaign targeting 200 organizations.
victims 200 organizations
More recently, CrowdStrike revealed that cyber-espionage group “Vapor Panda” used the pentesting framework in a global campaign targeting 200 organizations.
organisation Microsoft 365
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
organisation Google Workspace
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
organisation Customer
Data accessed by the attacker includes: Business contact details (names, email addresses, job titles, and company affiliations from the CRM systems) Customer account histories (product usage and connection or directory health)
organisation Slack
Customer communications (summaries and excerpts from sales calls, support discussions, and customer Slack conversations)
‎2026/11/03
A threat actor used an AI offensive security framework to automate reconnaissance and exploitation attempts, breaching the internal sales app of developer platform WorkOS.
infrastructure Cursor
According to its website, at least 3,000 companies use its services, including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, Webglow, and Netlify.
organisation Perplexity
According to its website, at least 3,000 companies use its services, including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, Webglow, and Netlify.
organisation Webglow
According to its website, at least 3,000 companies use its services, including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, Webglow, and Netlify.
Tactical Metrics
Metrics
victims
200
Organizations
More recently, CrowdStrike revealed that cyber-espionage group “Vapor Panda” used the pentesting framework in a global campaign targeting 200 organizations.
Metrics
infrastructure
‎Cursor
Affected Product
According to its website, at least 3,000 companies use its services, including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, Webglow, and Netlify.
Metrics
infrastructure
‎Microsoft 365
Affected Product
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Intelligence Sources
Mastodon BleepingComputer 2026-11-03
BleepingComputer 2026-11-03