WorkOS Says an Attacker Used an AI Offensive Framework on Its Sales App. Here Is the Audit of What You Pasted Into Vendor Support Tickets.
On November 2, WorkOS published a security bulletin saying it found unauthorized access to an internal application used by its sales team on October 30. The company says the investigation points to an AI-assisted offensive security framework that automated reconnaissance and exploitation attempts. It also says there is no evidence that production services were touched. If you build on a vendor like this, the interesting part is not their production system. It is the pile of context you gave their support and sales people.
What WorkOS actually said
The bulletin is short and fairly careful. WorkOS says its current analysis indicates the incident affected only CRM and customer support data. It lists the categories: business contact details (names, emails, phone numbers, job titles, company names), account and relationship history, summaries and excerpts from sales calls, support discussions and customer Slack conversations, and operational metadata such as product usage and connection or directory health.
The response so far: external access to the affected application was disabled, internal-tool access controls are under review, and an independent forensics firm was retained. The investigation is ongoing. WorkOS says it will contact affected customers directly and is still working out the impact per organization. The bulletin gives no record count, no entry path and no timeline.
One more detail worth noting: the WorkOS status page showed no incident for any day from November 1 through 6. That fits the claim that production was not affected, but a status page tracks availability, not security, so it proves little either way.
The part that matters for a one-person company
Read that data list again. Support discussions. Customer Slack conversations. Call summaries. That is exactly where builders paste things they should not: an API key to reproduce a bug, a connection string, a screenshot of a dashboard with a customer's email on it, a redirect URI for a production app.
WorkOS does not say any of that was taken, and I am not claiming it was. The bulletin's only customer guidance is to verify unexpected requests before sharing sensitive information, which is phishing advice, not rotation advice. My point is narrower. When a vendor's sales or support system is the part that gets breached, the exposed material is whatever customers volunteered, and you are the customer.
I would also treat the "AI-assisted framework" line with some care. It is WorkOS's description of what its investigators saw. A third-party write-up I read names a specific tool and some user agents and attributes them to a news report, but I could not find that in the bulletin or confirm the report, so I am leaving the name out. What is solid is the general direction: automated reconnaissance gets cheaper, and internal sales tools are not exotic targets.
The 30-minute audit I'd run today
Pick the three vendors you have talked to support at most, probably your auth provider, your host and your payment or email service. For each one:
- Search your sent mail and their support portal for "key", "secret", "token", "password", "postgres://" and "Bearer". Keep it to your own account history.
- Open any shared Slack Connect channel with the vendor and scroll for pasted config.
- For anything that turns up and is still valid, rotate it. For anything that was already rotated, note that and move on.
- Check whether the vendor has emailed you directly. WorkOS says affected customers get a direct message, so silence from them is mildly reassuring, not conclusive.
Then fix the habit. Paste redacted config, send a minimal reproduction, and use a throwaway key with a short expiry when a support engineer genuinely needs one. Thirty minutes now beats a rotation scramble after a notice arrives.
Where this could be overblown
Maybe nothing of yours was in there. WorkOS may well be right that this stayed inside CRM and support data, and plenty of customers never pasted anything sensitive. If that is you, the audit takes ten minutes and you have lost nothing. The opposite risk is real too: a first bulletin from a vendor is provisional, and the investigation is still open, so the scope could grow.
What I'd actually do
Run the audit on every vendor you have ever opened a ticket with, starting with WorkOS if you use it. Rotate only where exposure is plausible rather than rotating everything out of panic. And make "never paste a live secret into a support channel" a written rule, even if the team is you.
Author
Lukas
@lukcombinator