Two developer-infrastructure companies disclosed breaches on November 3 that they tie to AI-driven attacks. Blockchain infrastructure provider Chainstack says an outside attacker reached part of its infrastructure “through a third-party component.” Per its incident page, the attacker got into a development environment on October 26 and some parts of production on October 29; Chainstack detected the intrusion and cut the access on October 31, and closed its investigation on November 2. The attacker accessed a database of customer account information (organization names, account holder names, member email addresses and password hashes) and had access to systems holding node credentials. Chainstack has no evidence the credentials were read but treats them as exposed. It says customer nodes, the console and the API were not modified and that it does not store full card numbers.
API platform WorkOS says that on October 30 it found unauthorized access to an internal application used by its sales team. The data involved was business contact details, customer account histories, summaries and excerpts of sales calls, support discussions and customer Slack conversations, and product-usage metadata. WorkOS says its investigation found an “AI-assisted offensive security framework” automating reconnaissance and exploitation. BleepingComputer reports that WorkOS founder Michael Grinich named the ARTEX AI penetration-testing suite, citing user agents such as artex-enrich/1.0 and norma/0.4, and that no WorkOS app data or production services were affected. The Hacker News says Chainstack’s incident shares overlaps with a China-linked cluster using ARTEX; Chainstack’s own page does not name a framework or a group. See our earlier post on CrowdStrike’s report of VAPOR PANDA running ARTEX against 200 organizations. The Hacker News also notes that Chainalysis disclosed a separate intrusion by an “external actor using offensive agentic techniques” the week before, which Chainalysis says is unrelated to the Binance theft.
How to check if you’re affected
Affected products are Chainstack accounts and WorkOS customer relationships. Chainstack is emailing all customers and asks them to:
- Change their Chainstack password, and the password on any other service where it was reused.
- Rotate their node credentials. Self-service rotation is available in the console, and current endpoints keep working until you complete it, so there is no downtime.
- Regenerate their platform API keys if they use the platform API.
- Watch for phishing; Chainstack says it will never ask for passwords, tokens or keys.
WorkOS says it is still reviewing which organizations’ records were affected and will contact affected customers directly. Its guidance is to verify unexpected requests before sharing sensitive information or acting, even when a message mentions a real colleague or a past support conversation.
Sources
- Chainstack: Incident report: what happened and what customers need to do
- WorkOS: October 30th, 2026 Data Security Incident
- Chainalysis: Security Incident Information (updated Nov 2)
- BleepingComputer: WorkOS says attacker used ARTEX AI to breach internal sales app
- The Hacker News: Chainstack Reports Production Systems Breach Exposing Customer Data and Password Hashes