What to do
As of 10 November 2026
What WorkOS told its customers, followed by clearly labelled general advice.
What WorkOS told its customers
WorkOS's first bulletin asks customers to stay alert to phishing and social engineering, and to "verify unexpected requests before sharing sensitive information or taking action." [1] Phishing means messages that pretend to come from someone you trust; the business details in the tool could make such messages more convincing. [1]
WorkOS says it will contact affected customers directly. [1]
General good practice (not from the sources)
This short list is general advice, not advice from WorkOS or any outlet.
- Anyone testing AI hacking agents: block all outside network access from the test environment, and check that the block holds before each run.
- Anyone testing AI hacking agents: if an agent reaches a system outside the test, tell the system's owner promptly, as this researcher did.
- Companies: keep internal tools off the open internet, and never let development credentials work on live systems.
- Companies: cap request rates on internal programming interfaces and alert on unusual volumes.
For WorkOS customers No source says sign-in data or customers' own users' accounts were touched. Treat unexpected messages that mention your WorkOS account details with care.
Sources
- WorkOS, “October 30th, 2026 Data Security Incident,” 2 Nov 2026 (primary source) — https://workos.com/security/bulletins/october-30th-2026-data-security-incident