WorkOS reported a security breach on October 30, 2026, involving unauthorized access to an internal application used by sales teams. The company's investigation revealed an AI-assisted offensive security framework designed to automate reconnaissance and exploitation. Hackers Employ AI-Driven Attack Toolkits The affected application provided access to business contact information, including names, email addresses, telephone numbers, job titles, and company affiliations.
The disclosure highlights the increasing operational use of agentic offensive frameworks, which can interpret target responses and select subsequent actions beyond predetermined sequences. In related research, Wiz documented ARTEX-associated activity involving application mapping, authentication probing, password spraying, and tenant-isolation testing. Attackers downloaded JavaScript bundles and exposed source maps to identify internal API routes, then tested authentication flows and access controls.
Google Threat Intelligence Group and Mandiant separately disclosed that attackers exploited frameworks such as ARTEX and PentAGI during real-world intrusions.
Their reports highlight the acceleration of automation in discovering permissions, conducting reconnaissance, moving laterally, and preparing for data theft. Customers are advised to verify any unexpected requests through established channels before sharing sensitive information or taking requested actions, especially when messages reference prior business discussions.
