GoKawiilGitBook suffers credential-theft attack, takes services offline
GitBook confirmed that on November 2 at 19:00 CET, attackers using AI agents gained unauthorized access to some infrastructure credentials. The company took its app and authenticated docs sites offline while keeping public content cached and live, then restored services after replacing credentials and revoking API tokens. GitBook says the attackers may have accessed Git Sync secrets, API tokens, third-party integration tokens, and visitor questions to GitBook Assistant, though no content appears to have been modified.
GoKawiil's interpretation of the reporting above, not reported fact.
The use of AI agents in the attack, as described by GitBook, could signal a shift toward more automated and scalable credential-targeting attacks against SaaS platforms. Because the breach touched third-party API tokens and integration secrets, the exposure risk may extend beyond GitBook itself to the external tools customers connect to it, making customer-side remediation urgent. The disclosure reportedly reached some customers only through a support ticket reply rather than a formal breach notification, which could raise questions about GitBook's communication practices during the incident.
- GitBook experienced a credential-theft attack described as AI-agent-driven, starting November 2 at 19:00 CET.
- Potentially exposed data includes Git Sync secrets, GitBook and third-party API tokens, and GitBook Assistant visitor questions; no content modification was found.
- GitBook is urging customers to rotate API tokens, third-party secrets, and re-authenticate MCP server connections.
Source: news.ycombinator.com, 2026-11-03
Published there as: “Gitbook Breached”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.