GitBook discloses an AI agent attack incident, reporting that unauthorized access was gained to some of its infrastructure credentials, and urges users to rotate their keys.

GitBook, a platform widely used for document management in the crypto industry, released a security incident advisory stating that the platform suffered a complex targeted attack carried out via an AI Agent. On November 2, attackers gained unauthorized access to some infrastructure credentials. Upon detecting the attack, the GitBook team immediately took steps to contain the impact, temporarily shutting down the GitBook application and authenticated document sites to safeguard infrastructure security. As of now, the GitBook app, API, and published documents have been restored to access, though some services may still face performance issues. Investigations indicate attackers may have accessed integration tokens, Git Sync keys, API tokens, and questions submitted by visitors to GitBook Assistant. No evidence of tampering with user content stored on GitBook has been identified to date. GitBook noted that it has blocked the attackers, patched related vulnerabilities, replaced all credentials and keys in its infrastructure, and revoked all users' personal API tokens on the platform. The platform is urging users to rotate their existing GitBook API tokens, as well as third-party API tokens and keys used to connect GitBook with other tools; users of published integration services that include keys must also update the relevant keys, while GitBook MCP server users need to re-authenticate. GitBook recommends users contact their organization's administrator for assistance, adding that it will continue monitoring for potential attacks, enhance platform security measures, and release a detailed incident review report later.