GitBook resets customer tokens after attackers using AI agents accessed credentials
GitBook says an attacker using AI agents gained access to some of its infrastructure credentials on 2 November, prompting the documentation platform to take parts of its service offline and revoke customer API tokens. The company says integration tokens, Git Sync secrets, API tokens and questions sent to GitBook Assistant may have been accessed, but it has found no evidence that hosted content was modified.
Bottom line — GitBook has asked customers to replace connected credentials and reauthenticate its MCP server.
Go deeper 6
-
GitBook says it detected the intrusion immediately, blocked the attacker and replaced credentials and secrets across its infrastructure.
-
The app, API and published documentation were available again on 3 November, though GitBook said some services could remain degraded.
-
Customers are asked to rotate GitBook API tokens, third-party credentials connected to the platform, and secrets used by published integrations.
-
PancakeSwap temporarily took its documentation offline as a precaution, saying its app and systems were unaffected.
-
PancakeSwap later moved its documentation to infrastructure it controls; existing documentation links still work, according to Decrypt and TokenPost.
-
GitBook has not said how the attacker obtained the credentials or which AI systems were involved; it is preparing a fuller incident report, according to Altcoin Buzz and Decrypt.