Context: A WorkOS customer posted a breach notification they say they received, for an incident detected on October 30; it was not yet on WorkOS's website or trust center.
From Hacker News: It's not on their website or Trust center yet, but we received the following breach notification from WorkOS: We are writing to notify you of a data security incident that we detected on October 30, 2026 and are continuing to investigate.
The agent running on a remote machine can authenticate using your local SSH credentials. That means it can push to your private repos on GitHub, for example. Proof: https://github.com/openai/codex/pull/28131#discussion_r3410013180
A GitHub issue reports that opening Postman's desktop app added Postman plugins to Codex and Claude Code, a startup instruction hook and a remote MCP connection without the user's consent.
A customer posted a support reply about a GitBook breach; they say no official notification had been sent yet.
A poster says the data-sharing setting their team had turned off in Codex was switched back on without anyone opting in.