Documentation hosting platform GitBook said an attacker used AI agents on Nov. 2, 2026, to gain unauthorized access to some of its infrastructure credentials. The company said third-party integration tokens, Git Sync secrets, personal API tokens and questions submitted through GitBook Assistant may have been compromised.

GitBook reported detecting the incident at around 19:00 Central European Time. It described the breach as a sophisticated, targeted attack and said it quickly blocked the attacker’s further access.

As a precaution, GitBook temporarily disabled its app and documentation sites that require authentication. Public pages remained available where possible through caching.

Potentially compromised information

GitBook warned that the attacker may have gained access to third-party integration tokens, Git Sync secrets, personal API tokens and questions submitted by users through GitBook Assistant.

The company said it found no evidence that the attacker made unauthorized changes to customer content.

Response and service restoration

GitBook said its specialists closed the vulnerabilities exploited by the attacker, rotated internal credentials and revoked customers’ API tokens.

The company advised users to update access keys and secrets for third-party integrations and reauthorize connections to the GitBook MCP Server.

As of Nov. 3, GitBook had restored its app, API and published documentation, although it said some services could continue operating with limitations.

GitBook said it would publish a detailed technical report after completing its investigation.

Binance founder Changpeng Zhao previously warned of a possible increase in cyberattacks involving artificial intelligence. According to Zhao, attackers are adopting new technologies faster than companies can deploy protective mechanisms.

Source: Incrypted