Botpress, the company behind the chatbot-building platform, has disclosed a security incident in which an intruder read the configuration of bots in 16 customer workspaces, potentially exposing the third-party credentials stored inside them. The disclosure was published on 6 November by the company's chief technology officer, Michael Masson.

On 12 October, someone began probing the authentication proxy that sits in front of several of Botpress's internal tools. A flaw in how the proxy validated sign-ins let the attacker enter with sessions that appeared to belong to Botpress staff. Between 13 and 21 October the intruder had access to internal tools and some of the systems they connect to, and used that time to learn how Botpress's systems work. Then, on the morning of 21 October, between 07:44 and 08:23 UTC, the attacker used a Botpress employee's API credential — which carried administrator access to a number of customer workspaces — to read the configuration of bots in 16 of them.

What was exposed, and what was not

A bot's configuration includes the settings of its installed integrations, and those settings can contain credentials for connected third-party services, including AI provider API keys, messaging-channel tokens and CRM credentials. Separately, the attacker used weaknesses in the setup flow of some integrations to change the settings of one integration in each of two other customer workspaces. Botpress says its logs cannot establish exactly which bots held a valid credential at the time, so it is asking affected customers to treat every credential stored in those bots as exposed. The company says it has contacted the owners of all 18 affected workspaces with lists of the bots and integrations involved, and that customers who were not contacted have no evidence their bots were read or changed.

Botpress says it has found no evidence of access to end-user conversations handled by customer bots, to its source code, build pipelines or published packages, or to employees' identity-provider accounts. It has received no ransom demand and has seen no sign that customer data has been published or offered for sale.

What Botpress has done

The company fixed the authentication flaw on 21 October at about 16:25 UTC, rotated the proxy's secret and revoked the employee credential the attacker had used. It blocked the accounts, workspaces and network routes associated with the attacker, hardened its ingress rules, reversed the changes made to internal settings and began rotating internal credentials. The attacker kept trying to get back in through other routes and new platform accounts, but Botpress says the attempts it observed through 3 November were rejected. Botpress says everything it has observed points to a single goal: obtaining AI usage that the attacker could resell on AI black markets. It is now changing the bot API so stored credentials cannot be reached this way again, and reviewing when staff should hold administrator access to customer workspaces.

Sources: Botpress; Unite.ai.