GitBook Breach: AI-Driven Attack Exposed Credentials and API Tokens

GitBook has disclosed a security incident involving a sophisticated attack that utilized AI agents to gain unauthorized access to the company’s infrastructure. The breach occurred on November 2 at 19:00 CET, when attackers accessed certain infrastructure credentials. GitBook stated that it detected the intrusion immediately and took the GitBook app and authenticated documentation sites offline to secure its systems, while keeping publicly published content live using cached data.

According to the company’s update, the investigation revealed that the attacker may have accessed Git Sync secrets, GitBook API tokens, third-party API tokens used for external tool connections, and questions submitted to the GitBook Assistant by site visitors. GitBook reported no evidence that customer content within the platform was modified during the incident.

To mitigate the impact, GitBook blocked the attacker, closed the relevant vulnerabilities, and replaced all credentials and secrets across its infrastructure. The company also invalidated all customer API tokens on its platform. Services were restored only after GitBook confirmed that its infrastructure was secure, though some services may still experience degraded performance as full restoration continues.

Customers are advised to rotate any existing GitBook API tokens, third-party API tokens, and secrets used in published integrations. Additionally, users of the GitBook MCP server are instructed to re-authenticate. GitBook stated that it is currently monitoring for further attacks, implementing additional security measures, and preparing a full post-mortem report with detailed information about the incident.