WorkOS 遭 AI 自主渗透框架 ARTEX 攻击泄露 CRM 数据
身份验证服务商 WorkOS 披露一起由 AI 辅助自主渗透测试框架 ARTEX 发起的安全事件。攻击者通过内部 API 访问了 Salesforce 和 Snowflake 中的客户业务联系信息，但未涉及应用数据或生产服务。该事件凸显了自主智能体在网络安全领域的潜在风险与新型攻击向量。
报道正文
It's not on their website or Trust center yet, but we received the following breach notification from WorkOS:
We are writing to notify you of a data security incident that we detected on October 30, 2026 and are continuing to investigate. We value your trust and want to keep you informed while our investigation continues.
What Happened
On October 30, 2026, at 16 UTC, WorkOS detected anomalous traffic to an internal business system. Our investigation identified evidence the attack was likely driven by ARTEX, an AI-assisted, autonomous penetration testing framework, from IP addresses based in Hong Kong and China.
The unauthorized actor gained access to an internal API used by our sales and marketing tools. Through this service, it was able to access data from our Salesforce and Snowflake instances. These systems hold business contact information, account and commercial information, aggregated and de-identified product usage metrics, marketing contacts, and support tickets. This includes CRM information such as names, email addresses, phone numbers, company mailing addresses, and other business information for WorkOS customers.
We have no evidence that your application data was accessed. We also have no evidence that any production WorkOS services were accessed or impacted. Our current analysis indicates this incident was localized to only CRM and customer support data.
...
作者发帖说明（HN）：
It's not on their website or Trust center yet, but we received the following breach notification from WorkOS:
We are writing to notify you of a data security incident that we detected on October 30, 2026 and are continuing to investigate. We value your trust and want to keep you informed while our investigation continues.
What Happened
On October 30, 2026, at 16 UTC, WorkOS detected anomalous traffic to an internal business system. Our investigation identified evidence the attack was likely driven by ARTEX, an AI-assisted, autonomous penetration testing framework, from IP addresses based in Hong Kong and China.
The unauthorized actor gained access to an internal API used by our sales and marketing tools. Through this service, it was able to access data from our Salesforce and Snowflake instances. These systems hold business contact information, account and commercial information, aggregated and de-identified product usage metrics, marketing contacts, and support tickets. This includes CRM information such as names, email addresses, phone numbers, company mailing addresses, and other business information for WorkOS customers.
We have no evidence that your application data was accessed. We also have no evidence that any production WorkOS services were accessed or impacted. Our current analysis indicates this incident was localized to only CRM and customer support data.
...