GitBook has urged customers to replace API tokens and integration secrets after an attack involving AI agents compromised infrastructure credentials and potentially exposed customer data.
Summary
- GitBook said infrastructure credentials were accessed on Nov. 2, prompting service shutdowns and credential replacement.
- Potentially exposed data includes integration tokens, Git Sync secrets, API tokens, and visitors’ Assistant questions.
- Customers must rotate relevant credentials and reauthenticate connections to the GitBook MCP server.
- The app, API, and published documentation have returned, though some services could remain degraded.
According to GitBook’s incident notice, the attacker gained unauthorized access to some infrastructure credentials at 7 p.m. CET on Nov. 2, equivalent to 6 p.m. UTC or 1 p.m. U.S. Eastern time.
The documentation provider said it detected the attack immediately and moved to contain it. Its response included taking the application and documentation sites requiring authentication offline while securing its infrastructure.
Publicly published material stayed available through cached data for as long as possible, the company said. By its Nov. 3 update at 4:21 p.m. CET, the application, API and published documentation were available again, although restoration work continued on some services.
GitBook replaces credentials and revokes customer tokens
Describing the intrusion as a sophisticated, highly targeted attack using AI agents, GitBook said it blocked the attacker, closed the vulnerabilities involved, and replaced every credential and secret across its infrastructure.
The company invalidated customer API tokens and said services were brought back only after its team was confident they were secure.
Its investigation identified four categories of potentially accessed information: integration tokens, Git Sync secrets, API tokens, and questions submitted by documentation visitors to GitBook Assistant.
The notice described possible access to those records without stating that every customer’s information had been taken. It did not provide a customer count or a volume of potentially exposed records.
“At this stage, we have found no evidence that any of your content in GitBook was modified,” the company said.
GitBook’s statement addressed content integrity separately from possible exposure of credentials and Assistant questions. Its customer instructions covered credentials used both on GitBook and in connections to external tools.
Customers receive new instructions to rotate secrets
Customers have been told to rotate existing GitBook API tokens, with the company confirming that all personal API tokens were revoked during the incident.
The instructions extend to third-party API tokens or secrets used to connect other tools to GitBook. Customers with published integrations that use secrets should replace those secrets as well.
Users of the GitBook MCP server must reauthenticate their connection. The company directed customers to their organization’s administrator for help completing that process.
The guidance changed between GitBook’s two published updates. At 1:15 p.m. CET on Nov. 3, its initial notice said no customer action was required at that time and promised instructions once services returned.
By the later update, customers were being asked to replace credentials and reconnect the MCP server. GitBook described the incident as a platform-wide issue affecting a number of customers.
Trade.xyz restored its documentation earlier on Nov. 2
A separate documentation incident affected Trade.xyz on the morning of Nov. 2, when the trading platform identified unauthorized activity on its GitBook pages.
Trade.xyz said it restored the documentation to its previous state by 9:15 a.m. Eastern time. Users were nevertheless advised to avoid links within the documentation while its investigation continued.
The restoration time preceded the infrastructure access time disclosed by GitBook later that day. Neither announcement established that the incidents shared an attacker or an entry point.
Trade.xyz’s statement concerned its documentation and did not identify an intrusion into Hyperliquid’s underlying trading infrastructure. Its announcement gave no user loss figure, affected wallet count or attacker address.
Security researchers document AI agents in other intrusions
In an Oct. 30 research report, Google Threat Intelligence Group and Mandiant described attackers using AI-powered security-testing frameworks during real intrusions.
Researchers said they had observed tools including ARTEX, Hexstrike and CAIRN being abused across multiple stages of attacks. Since late August, incident-response teams had seen agent activity involving movement between systems, database exploitation and preparation to extract data.
Google’s report described compromised credentials and unpatched systems among the weaknesses exploited by such tools. It recommended controls including short-lived credentials, limited permissions, and separation between systems.
GitBook said it was monitoring for further attacks and introducing additional security measures. The company was preparing a full post-incident report with more detailed information about the intrusion.
