# GitBook Tells Customers to Replace Credentials After Security Breach

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/48157
Published: 2026-11-04T02:24:47.000Z
Updated: 2026-11-04T02:24:47.000Z
Section: Technology

> The company said an attacker using AI agents accessed infrastructure credentials and customer data may have been exposed. GitBook’s app and published documentation returned Nov. 3.

GitBook urged customers to rotate API tokens and integration secrets after it found an attacker had accessed infrastructure credentials, with customer data potentially exposed.

GitBook described the intruder as using AI agents and said the incident began at 1 p.m. ET (18:00 UTC) Nov. 2. The company temporarily took its app and authenticated documentation sites offline while securing its infrastructure. Public pages remained available from cached data as long as possible.

Information that may have been accessed included integration tokens, Git Sync secrets, API tokens and questions visitors sent to GitBook Assistant. GitBook did not confirm that any data was taken or provide affected customer or record counts.

GitBook said it stopped the intruder, patched the flaws, replaced internal credentials and secrets, and revoked customer API tokens. The company urged customers to create fresh credentials for GitBook and connected third-party services, then reauthenticate the GitBook MCP server.

The app, API and published documentation returned at 10:21 a.m. ET (15:21 UTC) Nov. 3, though some services could remain degraded. The GitBook Team said it had found no evidence that content in GitBook was modified.