GitBook Discloses AI Agent Attack Incident: Some Infrastructure Credentials Compromised by Unauthorized Access, Urges Users to Rotate Keys

BlockBeats news, November 4 - GitBook, widely used for documentation management in the crypto industry, has issued a security incident notice stating that the platform suffered a sophisticated targeted attack carried out using AI Agents. On November 2, attackers gained unauthorized access to some infrastructure credentials. Upon discovering the attack, the GitBook team immediately took measures to prevent the impact from spreading further and temporarily shut down the GitBook application and documentation sites requiring authentication to ensure infrastructure security. Currently, the GitBook application, API, and published documentation have been restored to access, but some service performance may still be affected. Investigation shows that attackers may have had access to integration tokens, Git Sync keys, API tokens, and questions visitors submitted to GitBook Assistant. No evidence has been found so far that user content within GitBook has been tampered with.

GitBook stated that it has blocked the attackers, fixed the relevant vulnerabilities, and replaced all credentials and keys in the infrastructure, while revoking all users' personal API tokens on the platform. The platform requires users to rotate their existing GitBook API tokens, as well as third-party API tokens and keys used to connect GitBook with other tools; users of published integration services that contain keys also need to update the relevant keys, and GitBook MCP server users need to re-complete authentication. GitBook recommends that users contact their organization's administrator for assistance, and states that it will continue to monitor for potential attacks, further strengthen platform security measures, and subsequently release a detailed incident post-mortem report.