INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

WorkOS data breach via ARTEX AI

| 2026-11-03 21:29 HIGH LOW AI-ENABLED ATTACK · AUTONOMOUS DATA BREACH
JSON
Executive Summary
AI-generated
On November 3, 2026, developer platform WorkOS suffered a data breach after a threat actor accessed business contact records and summaries of customer communications. The attacker used an AI-powered offensive security framework to automate reconnaissance and exploitation attempts, specifically ARTEX AI penetration testing suite, which was likely powering the attack. At least 3,000 companies use WorkOS services, including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, Webglow, and Netlify, but no production services were accessed or affected. The company notified directly affected customers and warned users to remain vigilant for phishing attempts leveraging the exposed information.
Technical Mitigations AI-generated
• Remain vigilant for phishing or social engineering attempts leveraging the exposed information. • Block or hunt for 'artex-enrich/1.0' and 'norma/0.4' user agents in web requests to detect potential ARTEX AI-powered attacks. • Use a reputable cybersecurity framework or tool that can detect and block 'artex-enrich/1.0' and 'norma/0.4' user agents to prevent potential attacks.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
CN KR
Incident Timeline
‎October 30, 2026
“On October 30, 2026, we identified unauthorized access to an internal WorkOS application used by our sales team,” the company says in an incident alert .
‎2026/11/03
Threat actors used an AI-powered offensive security framework, likely ARTEX AI, to automate reconnaissance and exploitation attempts against WorkOS's developer platform.
organisation Adaptive Security's
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
organisation CrowdStrike
More recently, CrowdStrike revealed that cyber-espionage group “Vapor Panda” used the pentesting framework in a global campaign targeting 200 organizations.
victims 200 organizations
More recently, CrowdStrike revealed that cyber-espionage group “Vapor Panda” used the pentesting framework in a global campaign targeting 200 organizations.
infrastructure Cursor
According to its website, at least 3,000 companies use its services, including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, Webglow, and Netlify.
organisation Perplexity
According to its website, at least 3,000 companies use its services, including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, Webglow, and Netlify.
organisation Webglow
According to its website, at least 3,000 companies use its services, including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, Webglow, and Netlify.
organisation Microsoft 365
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
organisation Google Workspace
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
organisation Customer
Data accessed by the attacker includes: Business contact details (names, email addresses, job titles, and company affiliations from the CRM systems) Customer account histories (product usage and connection or directory health)
organisation Slack
Customer communications (summaries and excerpts from sales calls, support discussions, and customer Slack conversations)
Tactical Metrics
Metrics
victims
200
Organizations
More recently, CrowdStrike revealed that cyber-espionage group “Vapor Panda” used the pentesting framework in a global campaign targeting 200 organizations.
Metrics
infrastructure
‎Cursor
Affected Product
According to its website, at least 3,000 companies use its services, including OpenAI, Anthropic, Cursor, Perplexity, Snowflake, Plaid, Webglow, and Netlify.
Metrics
infrastructure
‎Microsoft 365
Affected Product
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Intelligence Sources
BleepingComputer 2026-11-03
Mastodon BleepingComputer 2026-11-03