WorkOS and Trigger.dev Breach: Trigger.dev Environment Variables Exposed, WorkOS Sales Data Accessed, and What to Rotate This Week

Two developer platforms disclosed break-ins within days of each other. Trigger.dev says an attacker accessed the environment variables (where apps usually keep passwords and API keys) for some of its customer organizations. WorkOS says an attacker got into an internal sales tool and saw customer contact details and conversation summaries. If your developers, your agency or one of your software vendors uses either service, this is the week to rotate the secrets stored there and to treat unexpected messages about your account with suspicion.

What happened in the Trigger.dev breach

Trigger.dev runs background jobs and AI agent workflows for software teams. On Sunday, November 1, 2026, it published a post titled "Security Disclosure: Sunday November 1st."

What Trigger.dev confirms:

• It has blocked the exploit used in the attack.
• Its investigation found exposure across "a subset of organizations."
• The attacker had unauthorized access to environment variables for those organizations.
• It emailed the account owners of impacted organizations with steps to mitigate.

The matching entry on the Trigger.dev status page, posted at 10:50 pm UTC on November 1, is marked Resolved. It also says the company will follow up with more details.

What is not known yet: how the attacker got in, how many organizations were affected, when the access started, and whether any of the exposed values have been used. The disclosure does not mention AI API keys by name, and it does not say whether self-hosted Trigger.dev is affected.

What matters in practice is that environment variables are where teams normally store keys for AI providers, payment processors, databases and cloud accounts. If yours were in scope, assume every value in them could now be in someone else's hands.

What happened in the WorkOS breach

WorkOS provides login, single sign-on (SSO) and directory sync for software companies. Its security bulletin, dated Monday, November 2, 2026, says it found unauthorized access on Friday, October 30, to an internal application used by its sales and customer-facing teams.

What WorkOS confirms the attacker could see:

• Business contact details from its CRM: names, emails, phone numbers, job titles and company affiliations
• Account histories, sales details and customer relationship information
• Summaries and excerpts of sales calls, support discussions and customer Slack conversations
• Operational details about how customers use WorkOS, such as connection or directory health

WorkOS says it has no evidence that its application data or production services were accessed, and that its current analysis points to CRM and customer support data only. It says its investigation found the attacker used an AI-assisted offensive security framework to automate reconnaissance and exploitation attempts. It has disabled external access to the application, brought in an independent forensics firm, and says it will contact affected customers directly.

What is not known yet: how the attacker got into the tool, how many customers are affected, and who was behind it. The bulletin does not name an attacker. It also does not discuss API keys or secrets either way, so it confirms neither theft nor safety for them.

On the confirmed facts, the WorkOS incident is a data exposure, not a stolen-keys incident. The main risk is convincing phishing: someone who knows your contacts, your account history and what you recently discussed with a vendor can write a very believable email.

How this connects to the Northflank breach

Northflank, a cloud deployment platform, disclosed its own incident on October 30. We covered it in our Northflank breach post. Of the three companies, Northflank is the one whose status page reports that multiple users confirmed their AI keys had been used.

SecurityWeek, which grouped these disclosures together, reports that at least a dozen AI developer platforms were hit in the past month. It also says the incidents do not appear to be related. Nothing published so far confirms that WorkOS, Trigger.dev and Northflank were hit by the same attacker or campaign.

Why it matters for a company network or website

A modern website or app runs on several platforms, and each one keeps its own copy of your secrets. When one of those platforms is breached, your keys get exposed and your company pays for it: AI usage billed to your account, database access, or payment API calls you never made.

Three points for business owners and IT leads:

• You may not know you use these services. A contractor, agency or past developer may have set up Trigger.dev for a single feature. Ask.
• AI keys are worth money to attackers. A stolen key can run up usage on your bill or be resold, so check usage, not just whether someone logged in.
• Leaked sales data feeds phishing. If you buy from WorkOS, staff who deal with that vendor should expect targeted emails. Our post on AI phishing and fake login pages explains how these attacks get past MFA codes.

What to do this week

If your team runs its own servers and deployment tools, the same rotation discipline applies there too. Our self-hosting infrastructure page covers how we approach it, and who is patching your servers covers the ownership question.

WorkOS and Trigger.dev breach questions people are asking

Was my Trigger.dev account affected?

Trigger.dev says it emailed the account owners of impacted organizations. It has not published how many organizations were affected or how it identified them. Check your inbox and spam folder, and contact Trigger.dev if you are unsure.

Were AI API keys stolen in the Trigger.dev breach?

Trigger.dev confirms the attacker accessed environment variables. It does not mention AI keys by name. If you stored AI keys in an affected organization's environment variables, treat them as exposed and rotate them.

Did the WorkOS breach expose SSO or login data?

WorkOS says it has no evidence that its production services or application data were accessed. The data it confirms is CRM, sales and support information. The investigation is ongoing.

Is this the same attack as the Northflank breach?

Not confirmed. None of the companies has linked its incident to the others, and SecurityWeek reports that the recent incidents across AI developer platforms do not appear to be related.

Was AI used in the WorkOS attack?

WorkOS says its investigation found the attacker used an AI-assisted offensive security framework to automate reconnaissance and exploitation attempts. It does not name the tool or the attacker in its bulletin.

Should we stop using Trigger.dev or WorkOS?

That decision depends on what each company publishes next. Right now the practical steps are to rotate exposed secrets, check usage logs and warn staff about phishing. Then read the root cause details when they come out before you decide.

The bigger lesson

Every platform you plug into holds a copy of your keys, so a breach at any one of them becomes your problem. You cannot stop a vendor from being hacked. What you can do is know which vendors hold your secrets, keep those secrets narrow and capped, and be able to rotate them within an hour. Businesses that already have that list and that habit spent this week on a short checklist. The rest are still trying to work out what was in their environment variables.

For help mapping and locking down your secrets, see security hardening or request a quote.

Get security alerts like this by email, plus our free checklist, at /security-alerts.

Sources: Trigger.dev security disclosure; Trigger.dev status page incident; WorkOS October 30th, 2026 data security incident bulletin; Northflank security incident status page; SecurityWeek.