GitBook Says an Attacker Using AI Agents Took Infrastructure Credentials: What to Rotate Now

GitBook reported that an attacker gained "unauthorized access to some of our infrastructure credentials" at 19:00 CET on November 2, 2026, in what the documentation platform described as a "sophisticated, highly targeted attack using AI agents," and GitBook responded by taking its app and authenticated docs sites offline and invalidating every customer's API tokens. GitBook said it blocked the attacker, closed the vulnerabilities involved, replaced every credential and secret across its infrastructure, and restored the app, API and published docs by 16:21 CET on November 3, with some services still degraded. GitBook told customers to rotate GitBook API tokens, third-party integration tokens and secrets, and Git Sync secrets, re-authenticate the GitBook MCP server, and audit linked Git repositories; GitBook has not disclosed how the attacker got in or published evidence that AI agents were used, and said a full post mortem would follow "soon.

GitBook says an attacker used AI agents to break into its infrastructure, and the documentation platform responded by taking its app offline and revoking every customer's API tokens. In its security incident notice https://www.gitbook.com/status/security-incident-2026-11-03?ref=explainx , GitBook says the attacker got "unauthorized access to some of our infrastructure credentials" at 19:00 CET on November 2, 2026. GitBook hosts public docs, help centers and API references for many companies. That makes the incident a supply-chain concern for customers, because tokens and secrets that connect GitBook to other tools may have been exposed. The AI-agent label is GitBook's own description. It has not published technical detail, and we cannot verify it from outside. This post separates what GitBook states from what is still unknown. TL;DR: what is confirmed and what is not | Question | Answer | Source | |---|---|---| | What happened? | A "sophisticated, highly targeted attack using AI agents" | GitBook's own notice | | When? | 19:00 CET, November 2, 2026 | GitBook | | What was reached? | Some infrastructure credentials | GitBook | | What may have been accessed? | Integration tokens, Git Sync secrets, API tokens, questions asked to GitBook Assistant | GitBook | | Was customer content changed? | No evidence of modification so far | GitBook | | Service status? | App, API and published docs back as of 16:21 CET, November 3; some services degraded | GitBook | | How did the attacker get in? | Not disclosed | Gap | | Proof the attacker used AI agents? | Not shown publicly | Gap | Agents that act on your behalf need rules. See how explainx helps secure your agents → https://explainx.ai/agentbeam?src=blog note What GitBook says it did According to the notice, GitBook detected the attack right away and moved fast. The company says it: - Blocked the attacker and closed the vulnerabilities involved. - Replaced every credential and secret across its infrastructure. - Brought services back only once it was confident they were secure. - Invalidated every customer's API tokens on the platform. It also took the GitBook app and authenticated docs sites offline to be sure the infrastructure was secure. Publicly published content stayed up as long as possible from cached data. An earlier update at 13:15 CET on November 3 described a "platform wide issue affecting a number of customers" and said the data review was still going. By 16:21 CET the app, API and published docs were available again. GitBook says it will keep monitoring for further attacks, add security measures, and publish a full post mortem "soon". What customers need to do GitBook's list of actions is short but easy to miss if you did not get the email. Do all of these: 1. Rotate GitBook API tokens. All personal API tokens were revoked during the incident, so anything that used one will fail until you create a new one. 2. Rotate third-party tokens and secrets that you use to connect other tools to GitBook. This includes secrets you gave GitBook for integrations. 3. Rotate secrets for published integrations that use them. 4. Re-authenticate the GitBook MCP server if you use it. Our explainer on the Model Context Protocol https://explainx.ai/blog/what-is-mcp-model-context-protocol-guide covers why an MCP connection holds its own credentials. 5. Check Git Sync. Git Sync links your docs to a Git repository. Git Sync secrets may have been seen, so review the access of the deploy key or app you gave GitBook, and look at recent commits in the linked repo. 6. Tell your admin. GitBook says to contact your organization's admin to help with the process. If a leaked secret reaches a code host, it can be used to read or push to repositories. Treat the Git side as the higher-risk path and audit it first. Why the Assistant questions matter One item on the exposure list is easy to overlook: questions asked to GitBook Assistant by your site visitors. The Assistant answers questions from your docs, so people type real problems, product names and sometimes pasted snippets into it. If those queries were accessed, they could reveal what customers struggle with, and in the worst case, data they pasted by mistake. GitBook has not said how many questions were reachable or whether any were copied out. Customers who run an Assistant on public docs should assume the text of recent queries may be read, and should check whether any contained personal data or secrets. The AI-agent claim: what we can and cannot say GitBook is not the first company to blame AI agents for an intrusion, and we have been tracking the pattern. Earlier cases include a Hugging Face breach attributed to an autonomous agent https://explainx.ai/blog/hugging-face-autonomous-ai-agent-breach-july-2026 and Google's report on stolen cloud AI access https://explainx.ai/blog/google-gtig-llmjacking-llm-mixers-1-million-stolen-cloud-ai-access-what-to-do-2026 . The UK's NCSC has also warned that AI will raise ransomware risk https://explainx.ai/blog/ncsc-state-of-the-cyber-nation-ai-ransomware-uk-critical-infrastructure-2028-highly-likely-2026 . Still, "used AI agents" can mean many things: automated reconnaissance, an agent running a scripted chain of steps, or something more novel. GitBook gives none of the specifics. We treat the label as a vendor statement. What makes the incident notable is the speed GitBook describes, with detection and containment within hours, and the breadth of the response, a full credential reset. Timeline from GitBook's notices | Time | Event | |---|---| | Nov 2, 19:00 CET | Attacker gains access to some infrastructure credentials, per GitBook | | Nov 2, shortly after | GitBook says it detects the attack and blocks further impact | | Nov 2 to 3 | App and authenticated docs sites taken offline; public docs served from cache where possible | | Nov 3, 13:15 CET | First public notice: "platform wide issue affecting a number of customers", data impact still under review, no action required yet | | Nov 3, 16:21 CET | Updated notice: services back, data exposure list published, rotation steps given | Notice what changed between the two updates. The first said no customer action was needed. The second listed four kinds of secrets and told everyone to rotate. If you read only the early message, you may have missed the instruction, so go back to the current notice. How to audit your own exposure in an hour You do not need to wait for the post mortem to check for damage. A practical sequence for a team that uses GitBook with Git Sync: 1. List every place a GitBook token lives. Search your CI settings, secret managers, scripts and docs-as-code repos for GitBook API keys and integration secrets. Replace each one. 2. Review the linked repository. Look at commits, branches and pull requests from the last 48 hours that you do not recognize. Check the audit log of your code host for new deploy keys or app installs. 3. Review published integrations. If you publish an integration that stores a secret, rotate it and tell your own users. 4. Search the Assistant logs. If your docs allow visitor questions, skim recent queries for pasted credentials or personal data, and rotate anything you find. 5. Watch outbound traffic. Look for unexpected use of rotated or old tokens in your logs. Failed use of a revoked token is a useful signal that someone holds a copy. 6. Record what you did. If your company has breach-notice duties, write down the time you learned of the incident and the steps you took. This is general incident hygiene, not advice tied to GitBook's internal findings. GitBook has said it found no evidence of content changes, so a clean review is the likely outcome, but the cost of checking is low. What developers are saying The Hacker News thread on the incident has dozens of comments. A few points stand out: - A commenter, philipwhiuk, noted that the early status page summary https://news.ycombinator.com/item?id=50354693&ref=explainx did not yet mention unauthorized access, and pointed to the incident page as the real disclosure. - Commenter latchkey asked for more detail https://news.ycombinator.com/item?id=50355677&ref=explainx : which infrastructure, and how the attacker got in. GitBook's notice does not answer that yet. - A user who says they are GitBook's CTO, posting as SamyPesse, wrote that the team had been dealing with the attack since the previous day https://news.ycombinator.com/item?id=50355659&ref=explainx and took a large share of services offline to put user security first. We could not verify that account independently, so read it as a claim. - Commenter aliasxneo quoted the AI-agents sentence https://news.ycombinator.com/item?id=50354914&ref=explainx and added "Add it to the list, I guess", a wry comment that such claims are becoming common. Lessons for anyone who runs docs or agents in production - Docs platforms hold real secrets. Integration tokens and Git sync keys are often long-lived. Give them the narrowest scope and an expiry date. - Keep an inventory. Know which third-party tools hold a token for your repos, so rotation takes minutes, not days. - Assume prompts are data. Chat widgets on public sites log what visitors type. Warn users not to paste secrets, and set retention limits. - Detect fast, reset broadly. GitBook's full credential reset is the standard response when you cannot tell which secret was touched. - Add runtime guards for your own agents. AgentBeam https://agentbeam.com/?ref=explainx , from the explainx.ai team, stops AI agents before they take dangerous actions, which limits damage if an agent or a token is misused. Our Beam CLI guide https://explainx.ai/blog/beam-cli-open-source-agent-security-skills-guide-2026 shows the open-source side, and the related Postman plugin report https://explainx.ai/blog/postman-desktop-auto-installs-codex-claude-code-plugins-self-approved-hook-issue-14370-2026 shows how tools can touch agent config. What is still open - The entry point and the infrastructure involved. - How many customers and how many Assistant queries were reachable. - Evidence behind the AI-agent description. - Whether any exposed secret was used against a customer. GitBook says it found no content modification, which is not the same as no misuse elsewhere. - The date of the post mortem. We will update this post when GitBook publishes its post mortem. The live source is the GitBook status page https://status.gitbook.com/?ref=explainx . Related reading Details reflect GitBook's incident notice as updated on November 3, 2026, and may change.