GitBook Urges Users to Rotate API Keys After AI Agent Attack

GitBook said attackers used AI agents to obtain some infrastructure credentials in a targeted operation that may have exposed user tokens and questions submitted to its assistant. It urged users to rotate API keys.

The access began at 1 p.m. ET Nov. 2 (18:00 UTC), corresponding to 2 a.m. Beijing time Nov. 3. Potentially exposed information included integration tokens, Git Sync keys, API tokens and visitor questions sent to GitBook Assistant. GitBook said it had found no evidence that customer content was altered.

GitBook revoked all personal API tokens and replaced all credentials. Service was restored at 10:21 a.m. ET Nov. 3 (15:21 UTC).

The company advised users to rotate GitBook and third-party API tokens and keys, then reauthenticate the GitBook MCP server. PancakeSwap temporarily took down its GitBook-hosted documentation after the incident. GitBook hosts documentation used by crypto projects, placing publishing credentials and visitor interactions within the scope of the response.