GitBook Says an Attacker Using AI Agents Reached Its Infrastructure Credentials, and Tells Customers to Rotate Their Tokens
Documentation platform GitBook says it was hit by 'a sophisticated, highly targeted attack using AI agents' that gave an attacker access to some of its infrastructure credentials on November 2. It took its app offline, revoked all personal API tokens and says integration tokens, Git Sync secrets, API tokens and visitors' questions to GitBook Assistant may have been accessed. It has found no evidence that customer content was modified.
GitBook's breach is another company saying attackers used AI agents against it without saying how, which leaves customers with a list of keys to rotate but little detail on what happened. In a disclosure updated on November 3, the documentation platform said it had been "the target of a sophisticated, highly targeted attack using AI agents," and that at 19:00 CET on November 2 the attacker gained unauthorized access to some of its infrastructure credentials.
What may have been exposed#
GitBook said the attacker may have accessed integration tokens, Git Sync secrets, API tokens, and questions visitors asked GitBook Assistant. It said it has found no evidence that customer content was modified. It blocked the attacker, closed the vulnerabilities involved, replaced every credential and secret across its infrastructure, and invalidated customers' API tokens, it said.
The company took its app and authenticated docs sites offline while it secured its systems and said on the afternoon of November 3 that the app, API and published docs were available again. Decentralized exchange PancakeSwap took its documentation offline as a precaution and later moved it off GitBook, Decrypt reported.
What customers need to do#
GitBook told customers to rotate GitBook API tokens, third-party tokens and secrets used to connect other tools, and secrets in published integrations, and to re-authenticate the GitBook MCP server. It said a full post-mortem will follow.
Chainalysis has said that an attacker used "offensive agentic techniques" to reach its internal tools, and also did not give technical details.
Limits#
- GitBook has not said how the attacker used AI agents, which systems were involved, or how the credentials were obtained, Decrypt noted.
- The disclosure does not say how many customers were affected.