GitBook said it was hit by a cyberattack on November 2, 2026 in which attackers used AI agents to obtain unauthorized access to part of the company’s infrastructure credentials. The incident was detected at about 19:00 Central European Time, and the company said the attackers’ access was blocked quickly.

As a precaution, GitBook temporarily took down its app and documentation sites that require authentication, while keeping public pages reachable through caching. The company said there is no evidence that customer content was changed without authorization, but several categories of credentials and user data may have been exposed.

What may have been affected

According to GitBook, the potentially compromised information includes third-party integration tokens, Git Sync secrets, personal API tokens, and questions submitted by users through GitBook Assistant. The company did not say in the initial disclosure how many users or organizations were affected.

The reference to AI agents describes the method used in the attack, but GitBook has not yet published a full technical explanation of how the intrusion unfolded. For now, the company’s description is limited to unauthorized access to part of its infrastructure credentials.

Immediate response and service disruption

After detecting the attack, GitBook said it moved to contain the incident by blocking the attackers’ access and temporarily disabling parts of the service. The restrictions covered the app and documentation sites that require users to authenticate, while publicly available pages stayed online via cached versions.

The company also said it closed the vulnerabilities used in the attack, rotated internal credentials, and revoked customers’ API tokens as part of its response. Those steps were aimed at limiting further access and reducing the usefulness of any exposed credentials.

Steps users were asked to take

GitBook advised users to update access keys and secrets connected to third-party integrations. It also told customers to reauthorize connections to the GitBook MCP Server after the revocation of API tokens and related remediation work.

The guidance reflects the types of data that may have been at risk in the incident. Where integrations or personal tokens were exposed, rotating secrets and restoring trusted connections are standard containment measures.

Restoration and what comes next

By November 3, GitBook said its app, API, and published documentation had been restored. The company added that some services could still be operating with limitations as recovery work continues.

GitBook said it plans to publish a more detailed technical report after its investigation is complete. That report is expected to clarify the exploited vulnerabilities, the role of AI agents in the intrusion, and whether the scope of potential exposure changes as the review progresses.

Source: incrypted.com