Rendered at 02:50:04 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
grinich 2 hours ago [-]
Hi everyone - WorkOS CEO here.
WorkOS's production systems are secure. No customer platform data was accessed. This incident was isolated to internal GTM systems.
The attack involved ARTEX, an autonomous AI agent framework used to carry out offensive security operations. It's a striking example of how quickly the capabilities of attackers are evolving.
We've contained the incident, brought in independent experts to investigate, and are working through the details.
Security is something we take extremely seriously, and I believe in being transparent when things go wrong. We'll continue to share updates as we learn more.
If you are a customer and would like to have a call with our security team, please send a note to security@workos.com
minimaltom 2 hours ago [-]
Thanks for being so transparent.
Is it understood what the initial attack vector was? How confident are you that compromise is contained to just this GTM application (and lateral movement/exposure hasnt occurred)?
barrrrald 2 hours ago [-]
Thanks for the transparency
_pdp_ 2 hours ago [-]
> The attack involved ARTEX
Why does it matter what framework is used?
majorchord 2 hours ago [-]
> We have no evidence that your application data was accessed.
Translation: We don't know how we were hacked and can't tell what anyone did or didn't look at.
In that case I would treat it as full compromise and urge everyone who might be potentially affected to change password, rotate keys, whatever you need to do to protect yourself.
viraptor 40 minutes ago [-]
At any point, any company and individual is in the state of "We have no evidence that your application data was accessed." I get what you're trying to say, full verification is tricky, and there's nothing wrong with rotating credentials just in case in those situations. But you're implying way more than that and there's no reason for it.
WorkOS's production systems are secure. No customer platform data was accessed. This incident was isolated to internal GTM systems.
The attack involved ARTEX, an autonomous AI agent framework used to carry out offensive security operations. It's a striking example of how quickly the capabilities of attackers are evolving.
We've contained the incident, brought in independent experts to investigate, and are working through the details.
Security is something we take extremely seriously, and I believe in being transparent when things go wrong. We'll continue to share updates as we learn more.
Here’s the full post: https://workos.com/security/bulletins/october-30th-2026-data...
If you are a customer and would like to have a call with our security team, please send a note to security@workos.com
Is it understood what the initial attack vector was? How confident are you that compromise is contained to just this GTM application (and lateral movement/exposure hasnt occurred)?
Why does it matter what framework is used?
Translation: We don't know how we were hacked and can't tell what anyone did or didn't look at.
In that case I would treat it as full compromise and urge everyone who might be potentially affected to change password, rotate keys, whatever you need to do to protect yourself.