Summary
- WorkOS detected unauthorised access to an internal sales application on 30 October.
- Business contact information and records of customer communications were exposed.
- The company's investigation identified AI-assisted offensive tooling, while production identity services are not currently known to have been affected.
Enterprise identity provider WorkOS has confirmed unauthorised access to an internal customer-facing application containing business contact information and records of customer communications.
The company identified the activity on 30 October 2026 and published an initial account of the incident on 2 November, stating that its investigation had found no evidence of access to production identity services or customer application data.
The affected system was used by sales and customer-facing employees and contained information associated with customer relationship management and support activities.
WorkOS says the accessed records included business contact details and summaries of communications involving customers. The company is reviewing the affected information to establish the consequences for individual organisations.
The scope of the incident is therefore distinct from a compromise of the authentication services that WorkOS provides to software developers and enterprise customers.
Commercial systems contain sensitive context
WorkOS develops identity infrastructure used by applications to support functions including authentication, enterprise single sign-on, and directory integrations.
Customers depend on those services to manage access to their own applications, making the integrity and availability of production identity infrastructure an important part of the provider relationship.
The company has not identified evidence that the attacker accessed those production services during the incident under investigation.
However, internal sales and support applications can contain information that extends beyond ordinary public contact details.
Records of customer conversations may reveal the names of technical personnel, operational arrangements, previous support discussions, and information about the services an organisation uses.
When combined with legitimate business contact information, those details can help an attacker construct communications that appear to originate from a familiar supplier or account representative.
The resulting risk depends on the information obtained and how an attacker uses it. Access to a customer relationship record does not, by itself, establish access to passwords, authentication tokens, or the customer’s underlying application environment.
WorkOS has advised customers to scrutinise unexpected requests involving sensitive information, particularly where messages refer to familiar contacts or earlier conversations.
AI-assisted offensive tools identified
The company’s investigation also identified the use of an AI-assisted offensive security framework during the activity associated with the intrusion.
WorkOS reports that the tooling was used to automate reconnaissance and exploitation attempts.
Such frameworks can combine conventional scanning and security testing functions with systems capable of interpreting results and selecting additional actions.
The use of automated tooling can increase the speed at which an attacker examines an application and tests potential weaknesses, particularly where successive actions depend on the results of earlier attempts.
WorkOS has not established that an autonomous AI system independently planned or controlled every stage of the intrusion. The evidence instead identifies AI-assisted tooling as one component of the observed activity.
The distinction between an automated tool and a fully autonomous operation is relevant when assessing how attacks are conducted and which weaknesses enabled access.
Regardless of the tooling used, internal applications require appropriate access restrictions, monitoring, and control over the information available to their users.
Investigation continues
Following the discovery, WorkOS restricted access to the affected application and began reviewing its internal security arrangements.
The company has engaged external incident response expertise to assist its investigation and assess the information potentially exposed.
Individual customers may receive further information as the review progresses, particularly where records specific to their organisations are identified as affected.
The incident illustrates how a technology provider can experience a security compromise involving internal business systems while the production platform on which customers depend remains unaffected.
Those environments have different functions and security requirements, but both can contain information that warrants protection.
WorkOS continues to distinguish the confirmed exposure of customer relationship information from the absence of identified compromise in its production identity services.
The company has not yet published a final count of affected customer organisations or a complete account of the attacker’s access and activities.
