GitBook says an attacker using AI agents gained unauthorised access to some of its infrastructure credentials on 2 November.

GitBook called it "a sophisticated, highly targeted attack using AI agents" in its 3 November notice, and published a fuller post-mortem on 4 November. The attacker reached the credentials at 19:00 CET on 2 November, and GitBook took its app and documentation sites offline.

A flaw in GitBook's sign-on flow let the attacker create sessions acting as staff. That let them query the authentication information of a misconfigured GitHub App installed as an integration, reaching internal code repositories and a Cloudflare API key. Using that key, they reached production secrets, which granted full infrastructure access through a service account.

Sixteen hours offline

The attacker had access for about two hours and 45 minutes on the evening of 2 November, and 40 minutes early on 3 November. GitBook disabled every affected service account, stopping the attack and taking the app offline, then rotated every secret and API key in its infrastructure and every customer secret. The platform was back online at 11:56 UTC on 3 November, after about 16 hours down.

Data accessible included GitBook API tokens, integration tokens and secrets, Git Sync secrets, session signing secrets and questions visitors had asked GitBook Assistant. Billing information, passwords and IP addresses were not compromised, and no customer's hosted content was found modified.

Customers have been told to rotate GitBook API tokens, replace third-party tokens and secrets linked to GitBook, and re-authenticate the MCP server. PancakeSwap temporarily took its documentation offline as a precaution. GitBook has not named the agent framework, model or operator, or explained how it identified agent activity; chief technology officer Samy Pesse promised details in a longer post-mortem, and GitBook says the attack appears aimed at one customer.