Plataforma GitBook · Breach

GitBook revokes all API tokens after AI agent attack

Nov 03, 2026 · 1 min read

GitBook says an attacker gained unauthorized access to infrastructure credentials at approximately 7:00 p.m. CET on November 2, in a targeted attack involving AI agents. Integration tokens, Git Sync access keys, personal API tokens and questions submitted through GitBook Assistant may have been accessed; the company blocked the attacker, patched the exploited vulnerabilities and revoked all personal API tokens, and the app, API and published documentation are back online. Customers should rotate GitBook API tokens and any third-party credentials used by connected integrations, and GitBook MCP users must authenticate again.

By HIFY Radar newsroom Updated 11/03/2026 05:24 PM Get this every day →← Back to the feed 2 sources

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

An attacker gained unauthorized access to GitBook infrastructure credentials at approximately 7:00 p.m. CET on November 2, in a targeted attack involving AI agents, according to the company. Integration tokens, Git Sync access keys, personal API tokens and questions submitted through GitBook Assistant may have been accessed. GitBook blocked the attacker, patched the exploited vulnerabilities and revoked every personal API token.

Why it matters

Exposed API tokens and integration credentials could give third parties access to connected accounts and services. The platform is heavily used for crypto documentation, raising the risk for those customers. GitBook says it found no evidence that customer documentation was modified.

What to do

Rotate all GitBook API tokens and any third-party credentials used by connected integrations. GitBook MCP users must authenticate again.

For the technical team

Affected: Plataforma GitBook (documentação); credenciais de infraestrutura, tokens de integração, chaves de Git Sync e tokens pess · GitBook platform: integration tokens, Git Sync access keys, personal API tokens and questions submitted through GitBook Assistant.
Exploitation: Targeted attack confirmed by GitBook itself in its disclosure. The company says it blocked the attacker and patched the exploited vulnerabilities.
Fix: No software fix required from customers. GitBook patched the exploited vulnerabilities and rotated its infrastructure credentials. Mitigation: rotate API tokens, third-party integration credentials and re-authenticate on GitBook MCP.
Vector: Unauthorized access to GitBook infrastructure credentials in a targeted attack involving AI agents, detected at approximately 7:00 p.m. CET on November 2. The exploited vulnerabilities were patched by the company; the exact technical vector was not detailed. The app and authenticated documentation sites were taken temporarily offline during containment.
More details: Potentially accessed data: integration tokens, Git Sync access keys, personal API tokens and GitBook Assistant questions. GitBook found no evidence that customer documentation was modified. The app, API and published documentation are back online, although some services may remain degraded. The case drew attention among crypto projects that use the platform for documentation.

Timeline

11/03/2026 05:24 PM
GitBook's blog reiterates the call to rotate secrets; the case draws attention among crypto projects that use the platform for documentation.
11/03/2026 03:43 PM
First report: attack involving AI agents led GitBook to revoke all personal API tokens.