GitBook confirms AI agents reached infrastructure credentials in Nov. 2 intrusion

Attackers entered GitBook’s systems on Nov. 2, 2026, using AI agents, software that can act autonomously on a user’s behalf, to reach infrastructure credentials in a targeted attack, the company said in a Nov. 3 security disclosure.

GitBook said detection came right away and containment followed, according to Decrypt’s reporting on the company’s Nov. 3 security disclosure. Detection and containment began right after the intrusion started, GitBook’s disclosure said. GitBook’s disclosure put the start of unauthorized access at 7 p.m. Central European Time on Nov. 2. The outlet’s reporting covered GitBook’s same-day disclosure, which included a Central European Time for when access started and framed the attack as driven by AI agents.

GitBook’s Nov. 3 security disclosure described the attack as “a sophisticated, highly targeted attack using AI agents.” Potentially exposed categories include integration tokens, Git Sync secrets that connect documentation to code repositories, and API tokens. Decrypt’s summary of GitBook’s disclosure covered credential categories that might have been exposed and stressed links between documentation and outside code repositories. The company said no evidence showed any customer’s hosted content was modified.

As it secured infrastructure, GitBook took offline its application and documentation sites requiring authentication, but public docs remained available through cached copies. During remediation, it shut down authenticated documentation and application access, while publicly available documentation stayed readable through cached copies as backend systems were unavailable.

GitBook’s status notice said published documentation sites and the editor were down; by Tuesday afternoon the application, API, and published docs were back up, though some services remained degraded. The status page recorded the outage across the editor and published docs, noting core services were back by Tuesday afternoon with possible degradation during recovery.

The company told customers to rotate existing GitBook API tokens and said to replace third-party API tokens and secrets tied to external tool connections. Users of its Model Context Protocol server must authenticate again after the incident. MCP works as a protocol that lets AI assistants and software tools connect to services such as GitBook.

PancakeSwap took its cryptocurrency documentation offline as a precaution following the GitBook incident, despite saying its own systems were unaffected and that its docs and app were not compromised. The exchange pulled documentation from view and directed visitors to its homepage before moving documentation to infrastructure under its own control, with existing links continuing to work. It reminded users that documentation never requests wallet connections or token approvals.

Decrypt said GitBook’s disclosure involved AI agents that permitted unauthorized access to infrastructure credentials on Nov. 2, describing the attack as sophisticated and highly targeted. The outlet said GitBook had not explained the way AI tools were used, the AI systems involved, how credentials were obtained, or whether GitBook’s own AI products caused the intrusion.