An attacker using AI agents got into GitBook's infrastructure credentials. Every customer API token was revoked

GitBook, the documentation platform behind a lot of developer and crypto project docs, says it was hit by "a sophisticated, highly targeted attack using AI agents". It disclosed the incident on 3 November 2026.

What happened

According to GitBook, at 19:00 CET on 2 November the attacker gained unauthorised access to some of its infrastructure credentials. The company says it spotted the attack immediately and moved to block it.

To be sure its systems were clean, GitBook then took its app and its login-protected docs sites offline. Public docs stayed up for as long as possible from cached copies. By the afternoon of 3 November the app, the API and published docs were available again, with a few services still degraded.

What may have been taken

GitBook says the attacker may have accessed:

Integration tokens, Git Sync secrets (which connect docs to code repositories), API tokens, and the questions site visitors had asked GitBook Assistant, its AI helper.

It says it has found no evidence that any customer content in GitBook was modified.

What GitBook did

It blocked the attacker, closed the holes that were used, replaced every credential and secret across its infrastructure and invalidated every customer's API tokens. It brought services back only once it was confident they were secure, and says a full post-mortem is coming.

Customers have homework: rotate GitBook API tokens, rotate any third-party tokens or secrets used to connect other tools to GitBook, rotate secrets in published integrations, and re-authenticate the GitBook MCP server.

The knock-on effect

Crypto exchange PancakeSwap took its docs offline as a precaution, saying its docs and app were not compromised and reminding users that docs never ask you to connect a wallet. It later brought them back on infrastructure it controls.

What we don't know yet

GitBook hasn't said how the attacker used AI agents, which AI systems were involved, or how the credentials were obtained. Its notice doesn't say its own AI products were the way in. Those answers should come with the post-mortem.

Our take

This is our opinion. The scary part isn't that AI agents were involved; it's what a docs platform holds. Docs tools sit on tokens that reach code repos and other services, so treat them like any other piece of infrastructure: least-privilege integration tokens, short expiry, and a plan for rotating everything in one afternoon. If an AI assistant answers your visitors, remember its question log is data too.