GitBook Security Incident: AI Attack Puts API Tokens at Risk

GitBook Security Incident: What Was Exposed and What Users Must Do Now

A popular documentation platform has told its customers that attackers got into parts of its infrastructure. 

According to the official incident page, the company was the target of a sophisticated, highly targeted attack that used AI agents. 

This GitBook security incident may have exposed API tokens, integration secrets and questions asked to its AI assistant. 

Here is a simple, source-based guide to what is confirmed, what may be at risk, and what customers should do.

Source: SolanaFloor Post

What the Platform Reported

The company says the attacker gained unauthorized access to some infrastructure credentials at 19:00 CET on 2 November 2026. 

That time equals 18:00 UTC. It adds that it detected the attack immediately and acted swiftly to block further impact. 

An infrastructure credential is a login-style key that lets systems talk to each other inside a company’s servers, so losing control of one is serious.

To make sure its systems were fully secure, it took the main app and the authenticated docs sites offline. 

Publicly published content stayed live for as long as possible, using cached data. 

In simple terms, readers could still open public docs even while internal tools were offline. 

In an update on 3 November, it called the problem platform-wide and said a number of customers were affected.

Timeline of the GitBook Security Incident

The table below follows the official updates. Times are shown as published in CET:

The latest update is the most important one. It shows that the investigation moved from “data review ongoing” to a confirmed list of data that may have been reached.

What Data May Have Been Exposed

The investigation shows the attacker may have accessed four types of information:

• Integration tokens: keys that let outside tools connect to a customer’s account

• Git Sync secrets: credentials that link documentation to a code repository

• API tokens: keys that let software act on a customer’s behalf

• Assistant questions: the questions site visitors asked the AI assistant

The company says it has found no evidence that any customer content in the platform was modified. 

That is reassuring, but the word “may” matters. It means the attacker had the possibility of reaching these items, not that every item was taken.

The assistant is an embedded AI tool that answers questions using a customer’s docs and other connected knowledge, according to its product page. 

The questions are typed by visitors, so they can contain anything those visitors chose to write.

What Customers Must Do Now

The official page gives a clear checklist. The company revoked all personal API tokens during the incident and invalidated every customer’s API tokens on its platform. 

Customers should now take these steps:

• Rotate existing API tokens, since all personal ones were revoked

• Rotate any third-party tokens or secrets used to connect other tools

• Rotate secrets used by published integrations

• Re-authenticate the MCP server if you use it

• Ask your organization’s admin to help with the process

Rotating a token simply means creating a new one and deleting the old one. The table below sums up who should act:

Each of these steps is described on the same official page. Beyond that checklist, a few general habits can help any team: store secrets in a dedicated vault instead of shared documents, give every token only the access it needs, and review recent account activity for anything unusual. 

These are common good practices, not instructions from the company.

Conclusion

The company has restored its app, API and published docs, and it has given customers a clear list of steps. 

Still, the GitBook security incident is not fully explained, because the full post-mortem has not been published. 

Customers should rotate their tokens and secrets now, and follow the official status page for the next update.

Disclaimer

This article is for educational and informational purposes only and is not financial or investment advice. Crypto assets are high risk, their prices can be very volatile, and you can lose some or all of your money. Always do your own research and consider speaking with a licensed financial advisor before making investment decisions.