# GitBook: an AI-agent attack reached infrastructure credentials

> GitBook reports a targeted attack that used AI agents and reached some of its infrastructure credentials on November 2, 2026.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Incident
- **Published by:** GitBook
- **Disclosed:** 2026-11-03
- **Affects:** GitBook, GitBook Assistant, GitBook MCP server
- **Research by:** The GitBook Team
- **Primary source:** https://www.gitbook.com/status/security-incident-2026-11-03
- **Page:** https://theinjection.dev/items/gitbook-ai-agent-credential-breach/

An attacker using AI agents reached some of GitBook's infrastructure credentials on November 2, 2026. Integration tokens, Git Sync secrets, API tokens and questions sent to GitBook Assistant may be exposed. Customers must rotate secrets.

## What happened

GitBook detected unauthorized access to some of its infrastructure credentials at 19:00 CET on November 2, 2026, and describes the intrusion as a sophisticated, highly targeted attack that used AI agents. The GitBook Team posted a containment notice at 13:15 CET on November 3 and had the app, API and published documentation sites available again by 16:21 CET. A full post-mortem is promised.

## How it works

Access to GitBook's own infrastructure credentials put the secrets GitBook holds on behalf of customers in reach: integrations tokens, Git Sync secrets used to connect external repositories, API tokens, and the questions visitors typed into GitBook Assistant. GitBook has not said how the attacker obtained the credentials or which AI systems were involved. The company says it found no evidence that customer content was modified.

## Who is affected

Every GitBook organization is in scope, because the exposure sits in GitBook's shared infrastructure rather than in one customer's configuration. Teams that connect GitBook to other tools through integrations, Git Sync or the GitBook MCP server hold the secrets most likely to need replacing.

## What to do

Rotate GitBook API tokens, then rotate any third-party tokens or secrets used to connect other tools to GitBook, and the secrets behind any published integrations. Re-authenticate the GitBook MCP server. Personal API tokens were already revoked by GitBook, and tokens are viewed and revoked in the Developer settings of a GitBook user account.

## Quick facts

- **Affected:** GitBook app, API, published docs, GitBook Assistant, GitBook MCP server
- **Access began:** 19:00 CET, November 2, 2026
- **Contained:** 13:15 CET, November 3, 2026
- **Services restored:** 16:21 CET, November 3, 2026
- **Possibly exposed:** Integrations tokens, Git Sync secrets, API tokens, GitBook Assistant questions
- **Status:** Attacker blocked, every GitBook credential replaced, personal API tokens revoked
- **Action required:** Rotate GitBook and connected third-party tokens, re-authenticate the MCP server

## Questions

### Do I need to rotate my GitBook API tokens?

Yes. GitBook tells every customer to rotate existing GitBook API tokens, even though it already revoked all personal API tokens itself. Rotation also covers third-party API tokens or secrets used to connect other tools to GitBook, and the secrets behind any published integration. Tokens are viewed and revoked in the Developer settings of a GitBook user account.

### Was my GitBook documentation content changed?

GitBook says it found no evidence that customer content was modified. Published documentation sites and the editor went offline as a precaution while GitBook contained the attack, and cached public content stayed live. Content integrity is GitBook's own assessment at this stage, and the company says a full post-mortem will follow, so the finding may be revised.

### What happens to questions asked to GitBook Assistant?

Questions that visitors sent to GitBook Assistant are listed among the data that may have been accessed. Teams running internal or customer-facing documentation should treat those queries as potentially read by the attacker, because support questions often quote error messages, internal hostnames or configuration details. GitBook has not published a count of affected queries.

### Which AI systems did the attacker use against GitBook?

GitBook has not named the AI systems involved, nor said how the attacker obtained its infrastructure credentials. The notice describes only a sophisticated, highly targeted attack that used AI agents. Defenders comparing the incident with other agentic intrusions should treat the AI attribution as GitBook's own characterization until the promised post-mortem supplies technical detail.

## Sources

1. [GitBook Incident Notice](https://www.gitbook.com/status/security-incident-2026-11-03)
2. [GitBook API Tokens](https://gitbook.com/docs/developers/gitbook-api/authentication)