WorkOS Discloses October 2026 Security Incident Involving Internal CRM Tool and AI-Assisted Attacks

On November 2, 2026, WorkOS disclosed an investigation into unauthorized access to an internal sales application identified on October 30, 2026. The accessed data included customer relationship management (CRM) contact details, account histories, customer communication summaries, and product operational metadata. WorkOS stated there is no evidence that core application data or production services were accessed or impacted. According to the company's investigation, the intrusion involved an AI-assisted offensive security framework that automated reconnaissance and exploitation attempts. WorkOS disabled external access to the affected tool, retained an independent digital forensics firm to evaluate the scope, and alerted customers to potential phishing and social engineering risks leveraging communication context.

Key takeaways

• WorkOS identified unauthorized access to an internal sales application on October 30, 2026, compromising CRM data, business contacts, and customer communications.
• The company reported no evidence indicating that WorkOS production services or core application data were accessed or impacted.
• Investigation findings noted the use of an AI-assisted offensive security framework to automate reconnaissance and exploitation attempts.
• WorkOS disabled external access to the application, engaged an independent forensics firm, and alerted users to potential social engineering risks.