GitBook has revoked all personal API tokens after a targeted attack using AI agents gave an attacker unauthorised access to some of its infrastructure credentials on November 2, Decrypt reported. If you publish on GitBook or connect other tools to it, treat your old GitBook API tokens as dead: GitBook has already revoked them, and the company is telling customers to rotate linked secrets and re-authenticate the MCP server.
What GitBook revoked and what it confirmed are two different things. The revocation is platform-wide and total for personal API tokens. The confirmed exposure is far narrower: four categories of information that may have been accessed, with no customer count, record volume, attacker identity or explanation of how AI agents were used. Rotation is the response to the possible, not proof of a confirmed theft.
What to do if you use GitBook
If you connect anything to GitBook, replace your credentials now rather than waiting for the promised post-incident report: GitBook has already revoked all personal API tokens, so old tokens will not work, and linked secrets in those categories should be replaced, since any secret that may have been exposed could still be usable by anyone holding it.
- Rotate any existing GitBook API tokens and generate replacements for every integration that used them.
- Replace third-party API tokens and secrets that connect external tools to your GitBook workspace.
- Replace secrets stored in published integrations, since GitBook lists them among the credentials customers must rotate.
- Re-authenticate the GitBook MCP server, asking your organisation administrator for help if access is restricted.
What happened
The attacker gained unauthorised access at 7 p.m. Central European Time on November 2, and GitBook said it detected the intrusion immediately and moved to contain it, according to Decrypt. GitBook took its application and authenticated documentation sites offline while securing its infrastructure, and kept publicly available documentation accessible through cached copies. By Tuesday afternoon, GitBook said its application, API and published documentation were back, with some services possibly still degraded, and crypto.news pins that restoration to GitBook’s 4:21 p.m. CET update on November 3.
Customers who read only the first notice would have missed the action step. GitBook’s own initial notice, published on November 3, said no customer action was required at that time and promised instructions once services returned, as shown in GitBook’s disclosure. By the later 4:21 p.m. CET update, customers were being asked to replace credentials and reconnect the MCP server, according to crypto.news. Our own timeline reconstruction from those timestamps: 18 hours 15 minutes from unauthorised access to the first public notice, 3 hours 6 minutes for the message to flip from “no action required” to a rotation order covering tokens, secrets and MCP access, and 21 hours 21 minutes from access to reported restoration.
What may have been accessed, and what is still unknown
GitBook’s investigation identified four categories of potentially accessed information: integration tokens, Git Sync secrets used to connect documentation with code repositories (GitHub, GitLab and Bitbucket), API tokens, and questions submitted by documentation visitors to GitBook Assistant, according to crypto.news. The word “potentially” carries the whole story here: GitBook has not said these categories were stolen, only that they may have been accessed, and the company said it has found no evidence that any hosted content was modified. GitBook also said it blocked the attacker, closed the vulnerabilities involved and replaced every infrastructure credential and secret, according to Decrypt.
What GitBook has not provided matters just as much: no affected-customer count, no exposed-record volume, no explanation of how AI agents were used or which systems were involved, and no attacker identity. Its disclosure also does not establish that GitBook’s own AI products were responsible for the intrusion, according to Decrypt. GitBook says it is monitoring for further attacks and preparing a full post-incident report. One number must not be mistaken for the breach’s scale: GitBook says on its About page that it is used by more than two million people, including teams like Zoom, FedEx, Nvidia, Snyk and Google. That is a platform-reach claim, not an affected count, and no source converts it into one.
Two customer moves that do not prove a wider compromise
Decentralised exchange PancakeSwap temporarily took its GitBook documentation offline as a precaution, said its docs were not compromised and its app was not affected, and later moved its documentation to infrastructure under its own control, with existing links continuing to work, according to Decrypt. That move is a precautionary customer response, not evidence that PancakeSwap’s own systems were compromised. Trading platform Trade.xyz identified unauthorised activity affecting its GitBook documentation on the morning of November 2, restored it by 9:15 a.m. Eastern time and advised users not to click links in it while its investigation continued, according to crypto.news. But Trade.xyz restored its docs 3 hours 45 minutes before GitBook’s disclosed access time, and neither announcement established a shared attacker or entry point, so the two cannot be presented as one sequence.
This GitBook breach is a different platform and a different incident from the Railway, Warp, Zeabur, LiteLLM and Northflank developer-platform incidents covered earlier on TechReview.si, and no source in the reporting for this story links them to one campaign or one attacker.
