GitBook hit by AI-agent attack: API tokens and secrets may be exposed

What happened

GitBook said an attacker gained unauthorized access to some of its infrastructure credentials at 19:00 CET on November 2. The company describes the incident as a "sophisticated, highly targeted attack using AI agents." The attack was detected and blocked immediately, and the GitBook app and authenticated docs sites were taken offline as a precaution.

What data may be affected

According to GitBook's investigation, the attacker may have accessed:

• Git Sync secrets
• GitBook API tokens
• Third-party API tokens used to connect external tools
• Questions site visitors asked GitBook Assistant

The company says it has found no evidence that content inside GitBook was modified.

What users should do

GitBook says it already revoked all personal API tokens during the incident. It is still asking users to rotate existing GitBook API tokens, any third-party tokens or secrets used to connect tools to GitBook, and secrets used in published integrations. Those using the GitBook MCP server should re-authenticate it.

Why it matters

GitBook is a widely used platform for hosting product documentation. Because exposed API tokens and integration secrets can grant access to systems beyond GitBook itself, the risk is not limited to documentation. The incident stands out as a concrete example of AI agents being used in cyberattacks.