grinich

We identified and verified the attack vector and have no indication there is other compromise.

In addition to our in-house security team, we also have hired a 3rd-party firm to do their own investigation and validate our analysis.

We hope to share more about our findings once the investigation concludes.

Hi everyone - WorkOS CEO here.

WorkOS's production systems are secure. No customer platform data was accessed. This incident was isolated to internal GTM systems.

The attack involved ARTEX, an autonomous AI agent framework used to carry out offensive security operations. It's a striking example of how quickly the capabilities of attackers are evolving.

We've contained the incident, brought in independent experts to investigate, and are working through the details.

Security is something we take extremely seriously, and I believe in being transparent when things go wrong. We'll continue to share updates as we learn more.

Here’s the full post: https://workos.com/security/bulletins/october-30th-2026-data...

If you are a customer and would like to have a call with our security team, please send a note to [email protected]

We do a lot more than device fingerprinting including training custom fraud models. We don't broadly publish our techniques for detection since that would make them much easier to circumvent.

This is the problem we've been working on solving with WorkOS Radar. We run it for Cursor and a bunch of other AI companies who have a free trial that gives some free inference to test the product.

It turns out to be a pretty complex program to solve at scale. Token fraud is a lucrative market and the adversaries are surprisingly sophisticated. It's a cat-and-mouse game, accelerated with AI.

https://workos.com/radar

(If you'd like to work on this, we are hiring :))

Custom roles per-org is supported natively with WorkOS. (I'm the founder.)

I think we have the most advanced RBAC system. You can even map roles from custom IdP groups via SCIM.

More info here: https://workos.com/guides/user-provisioning-scim

Hi I'm the founder of WorkOS.

We're working on multi-app support. The large majority of our customers only have 1 app (ChatGPT, Claude, Cursor, etc.) but this isn't the case for developers building lots of side projects.

Also working on shipping an agent-friendly Dashboard. Stay tuned :)

Would love to hear any more feedback: [email protected]

WorkOS has a built-in workflow for all the complex SAML/SCIM attribute mapping.

https://workos.com/docs/directory-sync/attributes

Also certificate renewal flows:

https://workos.com/changelog/certificate-renewal-flow

(I'm the founder.)

Docs to migrate from Clerk to WorkOS: http://workos.com/docs/migrate/clerk

Claude Code can often one-shot it. Feel free to reach out if I can help!

WorkOS powers auth for OpenAI, Anthropic, Cursor, Vercel, Perplexity, Clay, Webflow, Granola, and a bunch of others. Free up to 1m users, you pay for enterprise features.

I'm the founder and happy to help. We've differentiated by focusing on "b2b auth" via SAML/SCIM, but today we do everything else. We also have products for feature flags, encryption, bot blocking, MCP auth, etc.

Fun fact, we actually launched on HN in 2020 :) https://news.ycombinator.com/item?id=22607402

What do you use for RBAC today? Do you have AI rewrite it every time?

If you’re looking for b2b identity, I’m the founder of WorkOS and we power this for a bunch of apps. Feel free to email me, [email protected]

OpenAI uses WorkOS for SSO and SCIM.

https://help.openai.com/en/articles/9627404-openai-chatgpt-s...

It's so bad

Here is a major vulnerability we disclosed earlier this year:

https://workos.com/blog/samlstorm

I got hit with the same kind of phishing attack a couple months ago

It's pretty incredible the level of UI engineering that went into it.

Some screenshots I took: https://x.com/grinich/status/1963744947053703309

They migrated SSO/SAML to WorkOS, and consumer auth to forked open source.

(self plug since you asked!)

WorkOS does exactly this. It's "Stripe for enterprise features."

https://workos.com

Our customers include OpenAI, Anthropic, xAI, Cursor, Perplexity, Vercel, Replit, Webflow, Clay, Hex, Carta, Plaid, Drata, Vanta, and many others. If you've used these products, you've used WorkOS!

WorkOS makes it easy to "cross the enterprise chasm." Here's a bit more of the backstory: https://x.com/grinich/status/1841569664465568248

We also launched on HN 5 years ago :) https://news.ycombinator.com/item?id=22607402

thank you! feedback very welcome if you have any suggestions for things to improve or ideas for what we should build next

also if anyone wants to go down the rabbit hole about why SAML is hard to implement, this is a pretty interesting writeup of a major 0-day vuln we discovered earlier this year: https://workos.com/blog/samlstorm

I started a startup to fix this exact problem integrating and configuring SSO/SAML.[0]

We launched here on HN 5 years ago[1] and today power SSO for OpenAI, Cursor, Vercel, and a thousand other apps. We also found the initial configuration step to be painful for users, so we built a self-serve wizard that enables enterprise admins to fix issues.[2]

It's still crazy how much complexity there is with enterprise identity systems and managing the user lifecycle for big orgs. It's like the whole thing is made of weird edge cases and even moreso when you add SCIM, RBAC, MFA, etc etc.

(If anyone reading this also loves suffering at the intersection of IAM and developer tools, we are hiring! Email in my profile :))

[0] https://workos.com

[1] https://news.ycombinator.com/item?id=22607402

[2] https://workos.com/admin-portal

Hey I'm the founder of WorkOS.

Glad things are working well for you. If you have any feedback/ideas, I would love to hear them. Thanks! [email protected]

Hey - I'm the founder of WorkOS. Happy to chat about the playbook we see with OSS projects spinning-off a commercial offering. It's pretty common and we work with a lot of these businesses, enabling them to continue investment in the ecosystem too. [email protected]

This is off topic, but I’m the founder of WorkOS and we love hiring people with your experience. (WorkOS powers SSO for OpenAI, Anthropic, Cursor, etc.)

Send me an email if you’re ever looking for a new job? [email protected]