GitBook Says an Attacker Using AI Agents Took Infrastructure Credentials: What to Rotate Now

GitBook says an attacker used AI agents to break into its infrastructure, and the documentation platform responded by taking its app offline and revoking every customer's API tokens. In its security incident notice, GitBook says the attacker got "unauthorized access to some of our infrastructure credentials" at 19:00 CET on November 2, 2026.

GitBook hosts public docs, help centers and API references for many companies. That makes the incident a supply-chain concern for customers, because tokens and secrets that connect GitBook to other tools may have been exposed. The AI-agent label is GitBook's own description. It has not published technical detail, and we cannot verify it from outside. This post separates what GitBook states from what is still unknown.

TL;DR: what is confirmed and what is not

Agents that act on your behalf need rules. See how explainx helps secure your agents →

What GitBook says it did

According to the notice, GitBook detected the attack right away and moved fast. The company says it:

• Blocked the attacker and closed the vulnerabilities involved.
• Replaced every credential and secret across its infrastructure.
• Brought services back only once it was confident they were secure.
• Invalidated every customer's API tokens on the platform.

It also took the GitBook app and authenticated docs sites offline to be sure the infrastructure was secure. Publicly published content stayed up as long as possible from cached data. An earlier update at 13:15 CET on November 3 described a "platform wide issue affecting a number of customers" and said the data review was still going. By 16:21 CET the app, API and published docs were available again.

GitBook says it will keep monitoring for further attacks, add security measures, and publish a full post mortem "soon".

What customers need to do

GitBook's list of actions is short but easy to miss if you did not get the email. Do all of these:

1. Rotate GitBook API tokens. All personal API tokens were revoked during the incident, so anything that used one will fail until you create a new one.
2. Rotate third-party tokens and secrets that you use to connect other tools to GitBook. This includes secrets you gave GitBook for integrations.
3. Rotate secrets for published integrations that use them.
4. Re-authenticate the GitBook MCP server if you use it. Our explainer on the Model Context Protocol covers why an MCP connection holds its own credentials.
5. Check Git Sync. Git Sync links your docs to a Git repository. Git Sync secrets may have been seen, so review the access of the deploy key or app you gave GitBook, and look at recent commits in the linked repo.
6. Tell your admin. GitBook says to contact your organization's admin to help with the process.

If a leaked secret reaches a code host, it can be used to read or push to repositories. Treat the Git side as the higher-risk path and audit it first.

Why the Assistant questions matter

One item on the exposure list is easy to overlook: questions asked to GitBook Assistant by your site visitors. The Assistant answers questions from your docs, so people type real problems, product names and sometimes pasted snippets into it. If those queries were accessed, they could reveal what customers struggle with, and in the worst case, data they pasted by mistake.

GitBook has not said how many questions were reachable or whether any were copied out. Customers who run an Assistant on public docs should assume the text of recent queries may be read, and should check whether any contained personal data or secrets.

The AI-agent claim: what we can and cannot say

GitBook is not the first company to blame AI agents for an intrusion, and we have been tracking the pattern. Earlier cases include a Hugging Face breach attributed to an autonomous agent and Google's report on stolen cloud AI access. The UK's NCSC has also warned that AI will raise ransomware risk.

Still, "used AI agents" can mean many things: automated reconnaissance, an agent running a scripted chain of steps, or something more novel. GitBook gives none of the specifics. We treat the label as a vendor statement. What makes the incident notable is the speed GitBook describes, with detection and containment within hours, and the breadth of the response, a full credential reset.

Timeline from GitBook's notices

Notice what changed between the two updates. The first said no customer action was needed. The second listed four kinds of secrets and told everyone to rotate. If you read only the early message, you may have missed the instruction, so go back to the current notice.

How to audit your own exposure in an hour

You do not need to wait for the post mortem to check for damage. A practical sequence for a team that uses GitBook with Git Sync:

1. List every place a GitBook token lives. Search your CI settings, secret managers, scripts and docs-as-code repos for GitBook API keys and integration secrets. Replace each one.
2. Review the linked repository. Look at commits, branches and pull requests from the last 48 hours that you do not recognize. Check the audit log of your code host for new deploy keys or app installs.
3. Review published integrations. If you publish an integration that stores a secret, rotate it and tell your own users.
4. Search the Assistant logs. If your docs allow visitor questions, skim recent queries for pasted credentials or personal data, and rotate anything you find.
5. Watch outbound traffic. Look for unexpected use of rotated or old tokens in your logs. Failed use of a revoked token is a useful signal that someone holds a copy.
6. Record what you did. If your company has breach-notice duties, write down the time you learned of the incident and the steps you took.

This is general incident hygiene, not advice tied to GitBook's internal findings. GitBook has said it found no evidence of content changes, so a clean review is the likely outcome, but the cost of checking is low.

What developers are saying

The Hacker News thread on the incident has dozens of comments. A few points stand out:

• A commenter, philipwhiuk, noted that the early status page summary did not yet mention unauthorized access, and pointed to the incident page as the real disclosure.
• Commenter latchkey asked for more detail: which infrastructure, and how the attacker got in. GitBook's notice does not answer that yet.
• A user who says they are GitBook's CTO, posting as SamyPesse, wrote that the team had been dealing with the attack since the previous day and took a large share of services offline to put user security first. We could not verify that account independently, so read it as a claim.
• Commenter aliasxneo quoted the AI-agents sentence and added "Add it to the list, I guess", a wry comment that such claims are becoming common.

Lessons for anyone who runs docs or agents in production

• Docs platforms hold real secrets. Integration tokens and Git sync keys are often long-lived. Give them the narrowest scope and an expiry date.
• Keep an inventory. Know which third-party tools hold a token for your repos, so rotation takes minutes, not days.
• Assume prompts are data. Chat widgets on public sites log what visitors type. Warn users not to paste secrets, and set retention limits.
• Detect fast, reset broadly. GitBook's full credential reset is the standard response when you cannot tell which secret was touched.
• Add runtime guards for your own agents. AgentBeam, from the explainx.ai team, stops AI agents before they take dangerous actions, which limits damage if an agent or a token is misused. Our Beam CLI guide shows the open-source side, and the related Postman plugin report shows how tools can touch agent config.

What is still open

• The entry point and the infrastructure involved.
• How many customers and how many Assistant queries were reachable.
• Evidence behind the AI-agent description.
• Whether any exposed secret was used against a customer. GitBook says it found no content modification, which is not the same as no misuse elsewhere.
• The date of the post mortem.

We will update this post when GitBook publishes its post mortem. The live source is the GitBook status page.

Related reading

• Binance's $6.3 billion hack: fake job interviews and internal AI tools, claimed vs verified

• Hugging Face autonomous AI agent breach

• Google GTIG: LLMjacking and stolen cloud AI access

• NCSC State of the Cyber Nation: AI and ransomware

• Railway engineer, AI agents and a port scan: claimed vs verified

• What is MCP, the Model Context Protocol

• Beam CLI: open-source agent security skills

Details reflect GitBook's incident notice as updated on November 3, 2026, and may change.