WorkOS Says AI Assisted Attack Exposed CRM and Support Data

WorkOS said in a security bulletin that it identified unauthorized access to an internal sales application on 30 October. The company found no evidence that attackers accessed its application data or production services.

The affected application contained names, email addresses, phone numbers, job titles and company affiliations. It also held account histories, summaries and excerpts of sales calls, support discussions and customer Slack conversations, product usage data and information about connection or directory health.

WorkOS said the attackers used an AI assisted offensive security framework to automate reconnaissance and exploitation attempts. The company disabled external access to the application, hired an independent digital forensics firm and began reviewing its internal access controls. It will contact affected customers after determining which records were involved. WorkOS warned customers that the exposed contact details and conversation history could make phishing attempts look legitimate.