Cases › security breach › LR-2026-0827
GitBook infrastructure credentials compromised in AI-agent-assisted intrusion
Preliminary Why: 1 report: crypto.news · subject to change · 1 independent report
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: fix reported
No source states: loss or records, developer and model, agent tool, could do, deployer.
Severity major: a live production compromise described as a platform-wide issue affecting a number of customers, with credentials and visitor questions potentially accessed.
GitBook, a documentation provider, reported that an attacker gained unauthorized access to some of its infrastructure credentials at 7 p.m. CET on Nov. 2, in what it described as a sophisticated, highly targeted attack using AI agents. GitBook said it detected the attack immediately and moved to contain it, taking the application and documentation sites requiring authentication offline while securing its infrastructure. It blocked the attacker, closed the vulnerabilities involved, and replaced every credential and secret across its infrastructure, invalidating customer API tokens. Its investigation identified four categories of potentially accessed information: integration tokens, Git Sync secrets, API tokens, and questions submitted by documentation visitors to GitBook Assistant. Customers were told to rotate GitBook and third-party API tokens and secrets and to reauthenticate connections to the GitBook MCP server. By its Nov. 3 update, the application, API and published documentation were available again.
What happened
No source tells the story step by step yet.
What was done
“GitBook blocked the attacker, closed the vulnerabilities involved, replaced every credential and secret across its infrastructure, invalidated customer API tokens, and told customers to rotate GitBook and third-party API tokens and secrets and reauthenticate connections to the GitBook MCP server; it said it was introducing additional security measures.”
Risks
Also89 incidents
Rising: 25 vs 4.0 a week
Sorted by rule from the case's fields; not yet read from the sources.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
ApplicationShort-lived, scoped credentials · Secrets kept out of the model's context · Separate identity for each agent · Least-privilege access for the agent · Alerts on unusual tool use · Activity logs · Sensitive-data checks on outbound data
Infrastructure / targetEvidence
- When it was found 2026-11-02
- What was done GitBook blocked the attacker, closed the vulnerabilities involved, replaced every credential and secret across its infrastructure, invalidated customer API tokens, and told customers to rotate GitBook and third-party API tokens and secrets and reauthenticate connections to the GitBook MCP server; it said it was introducing additional security measures.
No source states: a step-by-step account, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.
Show every field, with its source and grade
The AI system
What happened
Impact
Context
Notes on gaps
No customer count, record volume, or monetary loss is stated. The separate Trade.xyz documentation incident on Nov. 2 is described as unauthorized activity on GitBook pages with no stated AI involvement and no established link to the GitBook intrusion, so it is not recorded as a separate incident here. The Oct. 30 Google Threat Intelligence/Mandiant research report is a research report with no concrete dated incident and is not recorded. Extractor proposed values without quotes; dropped: .
LR-2026-0827 · version 1 · published 2026-11-04 after automatic checks; not yet checked field by field by a person · JSON