An autonomous AI agent walked into an internal WorkOS sales tool, and the company named the framework on its way out. Here is what ARTEX is, why it is suddenly everywhere, and what still stops it.
On November 2, WorkOS disclosed that someone gained unauthorized access to an internal sales application on October 30. The CEO did what almost no victim does: he named the tool, on the record. ARTEX, an open-source autonomous AI penetration-testing framework, was the weapon of choice. Production systems were not touched, but the sales tool held the bad stuff: business contacts, account relationships, call summaries and Slack excerpts from customer conversations.
This is the part that should keep security teams up at night. The stolen data is not just a compliance checkbox. It is the raw material for phishing that quotes your actual last conversation with the vendor, and does it convincingly enough to fool the person who was on the call.
What actually happened at WorkOS
WorkOS found the intrusion on October 30 and cut external access to the app, brought in an outside incident response firm, and began reviewing access controls. Their public assessment of the data taken reads like a sales team's worst nightmare: names, work emails, phone numbers, titles, company affiliations, account histories, sales call summaries, support discussions, Slack excerpts, and product usage metadata.
The company was explicit about why this matters beyond the usual breach hand-wringing. Support threads and call summaries give an attacker the context needed to impersonate WorkOS convincingly, or to impersonate a customer to WorkOS. When the follow-up email correctly references the day your contract renewal hiccuped, the link inside it looks like the most legitimate thing in your inbox.
No credentials were taken from the app itself, and no production authentication systems were compromised. That is the good news, and it is also the pattern: ARTEX does not need to crack the crown jewels. It needs one exposed internal tool with a working login.
ARTEX is a tool, not a vulnerability
Here is the crucial reframe. ARTEX is not a new class of bug. It is a framework, a Go application with a web console, that lets an operator spin up multiple AI agents that plan and execute attack steps on their own. It is model-agnostic: give it an LLM, and it will coordinate reconnaissance, credential attempts, exploitation and reporting across several agent sessions, at machine speed.
It was published openly on GitHub by an author using the handle Autumn-27, until the repo was taken down in October 2026 because of widespread abuse. The take-down did not work. Forks keep circulating, and threat intelligence teams have watched multiple actors adopt them, some financially motivated, some suspected of state backing.
The uncomfortable insight is that the hard parts of penetration testing were never the exotic exploits. They were enumeration, credential guessing, chaining small mistakes, and doing it faster than defenders can respond. That is exactly the work agents are good at.
The trail: from 2,250 tenants to a brokerage
ARTEX did not arrive with WorkOS. The framework has been showing up in incident reports for weeks.
Microsoft's Storm-0940 campaign, disclosed in October, used ARTEX to attempt sign-ins against more than 2,250 tenants, while also exploiting and breaching many of the same victims. Analysts noted the speed: in one observed instance, the timeline from initial targeting to privileged access was under three hours.
CrowdStrike linked ARTEX to intrusions against South Korean financial organizations that ended with stolen data, and separately tied it to an attack wave beginning mid-October that targeted more than 200 organizations, with post-exploitation confirmed at nine of them. Their analysts noted the operators ran the framework on models including DeepSeek v4.1-flash as the main session, with GLM-5.3 and Grok 4.6 spun up for extra parallel attack sessions.
Then there is the biggest claimed victim. GMO Internet acknowledged that attackers breached Onamae.com Desktop Cloud, a rented-Windows-server service popular with retail foreign-exchange traders running automated trading bots. Up to 26,739 servers could have been affected, and stolen credentials were used to place unauthorized orders at customer brokerages. GMO's CEO pointed to ARTEX as the tool behind the intrusion, though the public record supports claimed more than confirmed there, and an admission that internal engineers had flagged weaknesses that were never adequately addressed complicates the AI-tool story.
Why this feels different
Defenders have been through the attackers got smarter story before. What is different here is that intelligence is now a free download.
A competent pentest used to require a human who knew how to chain steps under pressure. ARTEX industrializes that. One operator, or one operator plus a rented bot account, can run campaigns against hundreds of organizations in parallel, adapt when a target fights back, and switch models mid-attack. The economics flipped: the tooling is free, the marginal cost of another target is nearly zero, and the speed advantage now belongs to the attacker.
The other shift is the attack surface. ARTEX does not need zero-days to be dangerous. It needs the things every growing company has: an internal CRM or support tool exposed to the internet, service accounts with standing credentials, an MFA gap on a legacy login, a vendor portal that trusted a phone number. The framework exists to find and chain exactly those ordinary weaknesses, and to do it in hours.
What we would do this week
- Cut internal tools off the public internet. CRM, support desks, admin consoles and monitoring UIs should sit behind SSO and a VPN or zero-trust gateway. If a sales tool is reachable from anywhere, an agent can reach it from anywhere.
- Inventory who and what can log in. Service accounts, API tokens and unused employee credentials are the favorites of agentic attackers. Find them, rotate them, and revoke the ones nobody owns.
- Treat MFA as a given, not a project. ARTEX campaigns lean on credential stuffing and session reuse. Phishing-resistant MFA on every external-facing login raises the cost per target fast.
- Watch for the after-shock. Assume stolen CRM data will be weaponized as convincing phishing within days, not months. Warn customers and staff that legitimate-sounding requests referencing real past conversations still need verification through a second channel.
- Talk to your vendors about their tooling. Your supply chain now includes the software your vendors run internally. Ask your critical vendors whether agentic pentest frameworks have been part of their security assessments, and what they do when one shows up.
The takeaway
ARTEX is not the last framework like this; it is the first widely-adopted one. Open-source autonomous offensive agents are now a permanent part of the threat landscape, and they are aimed at the boring weaknesses that live inside most companies.
The defense, thankfully, is also boring. Reduce exposure, clean up credentials, enforce MFA, and verify the requests that arrive in your inbox even when they quote your own last conversation. The agent is faster than any human attacker we have seen. It still needs the same door left open.
At aratech we build and harden the AI infrastructure our clients run on, which puts us on both sides of this story: building with agents during the day, and hunting for the doors they might walk through at night. If you want a second pair of eyes on what an autonomous attacker could reach inside your stack, that is exactly the conversation we like having.