Choose Rich Live
Tech

GitBook hit by AI-agent cyberattack accessing infrastructure credentials

Documentation platform GitBook revealed that an attacker using AI agents gained unauthorized access to internal infrastructure credentials, prompting the company to revoke all customer API tokens and take services offline while securing its systems.

GitBook company logo icon on a white background.
Image: @TheBlockCo

Documentation platform GitBook disclosed that it was targeted in a sophisticated and highly focused attack leveraging AI agents, resulting in unauthorized access to several of its infrastructure credentials at 19:00 CET on November 2, 2026. The platform immediately acted to block the breach and temporarily took its application and authenticated documentation sites offline to ensure system security.[4][5]

An internal investigation revealed that the attacker may have accessed integration tokens, Git Sync secrets, API tokens, and queries submitted to the GitBook Assistant by visitors. In response, GitBook closed the exploited vulnerabilities, replaced all credentials and secrets across its infrastructure, invalidated every customer's API tokens, and urged users to rotate their secrets. The company stated it has found no evidence that any hosted content was modified.[3][4]

By 16:21 CET on November 3, 2026, GitBook reported that its core application, API, and published documentation were back online, though some services remained degraded during the final stages of recovery. According to The Block, multiple customers were impacted by the incident, and crypto projects such as TradeXYZ separately noted suspicious activity related to their GitBook-hosted documentation.[2][4][5]

Key facts

  • GitBook reported that an attacker using sophisticated AI agents gained unauthorized access to infrastructure credentials at 19:00 CET on November 2, 2026.
  • The intruder potentially accessed integration tokens, Git Sync secrets, customer API tokens, and questions submitted to GitBook Assistant.
  • GitBook invalidated all customer API tokens, rotated internal infrastructure secrets, and advised users to rotate their credentials.
  • GitBook confirmed it found no evidence that any user content hosted on the platform was modified.
  • GitBook restored access to its app, API, and published documentation by 16:21 CET on November 3, 2026, with performance restoration ongoing.
  • The Block reported that multiple customers were affected, and crypto projects including TradeXYZ reported suspicious activity on their documentation sites.

Sources 路 5 sources

  1. CO

    Cointelegraph@CointelegraphPost on X 路

    馃毃 ALERT: GitBook says it was targeted by a sophisticated AI-agent-powered cyberattack that compromised infrastructure credentials and potentially exposed customer API tokens, integration secrets, and user queries. https://t.co/aoRUBUNoJ7

    Open source
  2. TB

    The Block@TheBlockCoPost on X 路

    THE BLOCK: GitBook confirmed unauthorized access to parts of its infrastructure, prompting the documentation platform to temporarily take services offline while it investigated the security incident. The company said multiple customers were affected, and it has yet to determine whether customer data was compromised, as crypto projects, including TradeXYZ, separately reported suspicious activity involving their GitBook-hosted documentation.

    Open source
  3. AN

    Aggr News@AggrNewsPost on X 路

    *GITBOOK REVEALS SECURITY BREACH FROM "SOPHISTICATED AI AGENTS" ON NOV 2: BLOG *GITBOOK REVOKES ALL PERSONAL API TOKENS, URGES USERS TO ROTATE SECRETS https://t.co/yyMtRnSC3X

    Open source
  4. DN

    DEGEN NEWS@DegenerateNewsPost on X 路

    BREAKING: GITBOOK SAYS IT WAS HIT BY A "SOPHISTICATED, HIGHLY TARGETED ATTACK USING AI AGENTS" SAYS THE ATTACKER MAY HAVE ACCESSED API TOKENS, INTEGRATIONS TOKENS AND GIT SYNC SECRETS ALL PERSONAL API TOKENS WERE REVOKED, AND USERS ARE TOLD TO ROTATE THEIR SECRETS SOURCE: https://t.co/Eqb0mlkR9Z

    Open source
  5. SO

    SolanaFloor@SolanaFloorPost on X 路

    馃毃NEWS: @GitBookIO, one of the most widely used documentation platforms among crypto projects, has suffered a targeted cyberattack involving AI agents, potentially exposing API tokens, integration secrets and questions submitted to GitBook Assistant.

    Open source