Hackers Breached GitBook Using AI Agents

The platform for hosting technical documentation, GitBook, reported on November 3, 2026, about a cyberattack in which an attacker gained access to part of its infrastructure's credentials. According to the company, the attack was carried out using AI agents. The incident occurred on November 2 at 7:00 PM Central European Time.

GitBook claims that it detected unauthorized access immediately after it occurred and took measures to mitigate the consequences. The company blocked the attacker, fixed identified vulnerabilities, and replaced the credentials and secret keys of its infrastructure. However, the developers did not disclose which AI systems were used in the attack and how the credentials were obtained.

During the security check, GitBook disabled the application and documentation sites that required authorization. Public materials remained accessible through cached copies where possible. By November 3, access to the application, API, and published documentation was restored, although some services might still operate with limitations.

What Data Might Have Been at Risk

Preliminary investigation results suggest that the attacker might have accessed API tokens, third-party integration keys, secret data for Git Sync to synchronize documentation with code repositories, as well as questions visitors asked the built-in AI assistant, GitBook Assistant.

The company stated that it has not yet found any signs of alterations to the materials hosted on the platform. However, the extent of potential access to confidential information remains unknown.

GitBook has revoked users' personal API tokens and recommended replacing access keys used for connecting third-party services. Owners of published integrations were also advised to update secret data, and users of the GitBook MCP server, which provides AI tool connectivity to the platform, need to reauthorize.

Reaction of Cryptocurrency Projects

The decentralized exchange PancakeSwap temporarily disabled its documentation following reports of the incident. The team emphasized that its materials were not compromised, and the main application continued to operate. Subsequently, PancakeSwap moved its documentation from GitBook to its own infrastructure, maintaining the functionality of previous links.

Separately, on November 2, the decentralized trading platform trade xyz reported unauthorized activity in its documentation on GitBook. The materials were restored to their previous state by 9:15 AM Eastern Time USA. During the investigation, users were advised not to click on links within the documentation. The connection of this case to the attack on GitBook's infrastructure has not been established.

GitBook continues to investigate and plans to publish a detailed report on the incident. The company has not yet clarified the attack mechanism, the extent of potential data compromise, or the number of affected users.