GitBook says an AI-driven attacker reached its production systems. Rotate your tokens now

In brief

GitBook, the documentation platform used by many software and crypto projects, has published a postmortem of a breach on 2 and 3 November 2026. The company says an attacker abused a flaw in its single sign-on (SSO) login flow to create sessions as GitBook staff, used a misconfigured GitHub App to reach internal code, found a Cloudflare API key and from there reached production secrets.

GitBook took its app offline from 20:32 UTC on 2 November to 11:56 UTC on 3 November, about 15 and a half hours. It describes the incident as "a sophisticated, highly targeted attack using AI agents" aimed at a single customer, but treats all customer data as exposed.

What GitBook says was exposed

By GitBook's account, the attacker was inside production for about two hours 45 minutes on 2 November and about 40 minutes early on 3 November. In that window the following were accessible:

• Credentials. GitBook API tokens, integration tokens and secrets, and session signing secrets.
• Connected repositories. The attacker could act as GitBook's GitHub and GitLab apps in repositories customers had granted them. GitBook says it cannot tell whether any action was taken there.
• Content. Documentation sites using authenticated access. GitBook's earlier notice also listed questions visitors asked GitBook Assistant.

GitBook says it found no evidence that other customers' content was modified, and that billing data, passwords and IP addresses were not compromised. It has published three attacker IP addresses as indicators of compromise.

The AI-agent claim

The AI attribution comes from GitBook alone. Its postmortem points to the speed and precision of the intrusion, but does not name the tools, models or techniques involved. Decrypt's reporting makes the same point. Treat "AI-driven" as the vendor's assessment, not an established finding.

What to do now

GitBook asks customers to:

1. Create new API tokens. All personal tokens were revoked, so scripts and apps using the old ones need updating.
2. Rotate third-party secrets used to connect other tools to GitBook, and secrets in any published integrations.
3. Regenerate the authenticated-access signing key if you run a custom backend, and update it there.
4. Re-authenticate the GitBook MCP server if your AI tools use it.

Git Sync keys for GitHub and GitLab were rotated by GitBook. ByteNib would go further: because GitBook cannot rule out actions in connected repositories, review recent commits, branch changes and webhook settings in any repository the GitBook app could reach. Search your logs for the three published IP addresses.

The wider lesson is the one GitBook draws itself: a SaaS vendor sits inside its customers' security perimeter. The path was a chain: first an SSO flaw that let the attacker create staff sessions, then a misconfigured GitHub App that opened internal code, then an exposed Cloudflare API key that reached production secrets and customer tokens.

Sources and scope

Facts, times and customer actions are from GitBook's security incident notice and postmortem, including its updates of 3 and 4 November 2026, checked on 5 November 2026. Context on the unexplained AI attribution is from Decrypt (secondary, 3 November 2026). GitBook has not said how many customers were affected or which AI systems were used; both remain unconfirmed. The advice to review connected repositories and search logs is ByteNib editorial analysis.

Drafted with AI assistance and reviewed by the editor before publication.

Cover illustration: AI-generated illustration: ByteNib

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.