Show
GitBook, a documentation platform used by software and Web3 projects, has reported a cyberattack involving artificial intelligence (AI) agents after an attacker gained unauthorized access to parts of its infrastructure, potentially exposing customer API tokens, integration credentials and other sensitive information.
According to the security incident report, the attack occured on November 2, 2026, at around 19:00 CET. GitBook temporarily took some services offline while securing its systems.
The documentation platform described the incident as a “sophisticated, highly targeted attack using AI agents.” GitBook said it detected the attack immediately and acted quickly to prevent further damage. However, the company temporarily shut down its application and authenticated documentation sites to investigate the incident and ensure its systems were secure.
During the disruption, GitBook kept publicly available documentation online for as long as possible using cached data. This allowed visitors to continue accessing published content while some parts of the platform remained unavailable.
GitBook identifies information that may have been exposed
During its investigation, GitBook found that the attacker may have accessed several types of customer information, including integration tokens, Git Sync secrets and API tokens. The attacker may also have accessed questions submitted by visitors to GitBook Assistant through customers’ websites.
These credentials help GitBook connect with other tools and services. API tokens, for example, allow applications to communicate with one another, while integration tokens and Git Sync secrets help users connect external services and manage their documentation.
Although the company confirmed that these credentials may have been accessed, it has not established whether they were stolen. GitBook also said it had found no evidence that the attacker modified any content stored on its platform.
Company revokes customer API tokens
Following the incident, GitBook blocked the attacker, addressed the vulnerabilities involved and replaced credentials and secrets across its infrastructure. It also revoked all personal API tokens on its platform to prevent the attacker from using potentially exposed credentials.
The company kept its application and authenticated documentation sites offline until it was confident that its systems were secure.
By November 3, GitBook confirmed that its application, API and published documentation were available again. However, it warned that some services could still experience reduced performance while it completed the restoration process.
Users asked to replace their connected credentials
GitBook has also asked customers to take additional steps to protect their accounts and connected services. Users must create new GitBook API tokens, even though the company has already revoked their previous personal tokens.
Customers must also replace third-party API tokens and secrets used to connect other tools to GitBook. Those with published integrations that use secrets must rotate those credentials as well.
Users who rely on the GitBook Model Context Protocol (MCP) server have been instructed to authenticate their connections again.
The company advised customers to contact their organization administrators for assistance with these steps.
GitBook incident comes amid October security breaches
The attack comes during a month of several major security incidents across the cryptocurrency and technology industries.
Binance reported an estimated $6.3 billion impact from its October 29 security breach, while its investigation uncovered additional points of entry beyond the initially suspected compromised engineer’s laptop.
Other reported incidents involved CoinDCX, Ledger-linked infrastructure, NEAR Intents and several decentralized finance platforms.
GitBook said it would continue monitoring its systems for further attacks and introduce additional security measures. It also promised to publish a full post-mortem explaining how the incident happened and what it would do to prevent similar attacks.
Also Read: Binance Co-CEO Takes Responsibility for $6.3B Hack, Details Security Overhaul