GitBook Revokes API Tokens After AI-Assisted Breach of Documentation Platform
GitBook told customers to replace API tokens and integration secrets after an unauthorized intrusion on November 2 that it attributes to AI agents. The company said it found no evidence that customer content was modified, but it has not said how many customers were affected.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What GitBook Disclosed
GitBook said an attacker gained unauthorized access to some infrastructure credentials at 7 p.m. CET on November 2, or 1 p.m. U.S. Eastern time, according to its incident notice. The company describes the intrusion as a sophisticated, highly targeted attack that used AI agents. It said it blocked the attacker, closed the vulnerabilities involved, and replaced every credential and secret across its infrastructure.
The company took its application and authenticated documentation sites offline while it secured the platform. By its November 3 update at 4:21 p.m. CET, the application, API and published documentation were available again, although restoration work on some services was still underway.
Scope of Possible Data Exposure
GitBook's investigation identified four categories of information that may have been accessed: integration tokens, Git Sync secrets, API tokens, and questions submitted by documentation visitors to GitBook Assistant. The notice described possible access to these records but did not say that every customer's data was taken. It gave no customer count and no volume of potentially exposed records.
On content integrity, GitBook said it has found no evidence that any customer content was modified. The company treats that finding separately from the exposure of credentials and Assistant questions.
Customer Action Required
Customer instructions have changed since the first notice. At 1:15 p.m. CET on November 3, GitBook said no customer action was needed at that time. By its later update, it was asking customers to rotate existing API tokens, with the company confirming that all personal API tokens had been revoked during the incident.
Customers were also told to replace third-party API tokens and secrets used to connect other tools to GitBook, and to replace secrets tied to published integrations. Users of the GitBook MCP server must reauthenticate, and GitBook directed them to their organization's administrator for help. GitBook described the incident as platform-wide, affecting a number of customers.
Related Trade.xyz Documentation Incident
Trade.xyz separately reported unauthorized activity on its GitBook pages on the morning of November 2. It said it restored the documentation to its previous state by 9:15 a.m. Eastern time and advised users to avoid links within the documentation while its investigation continued. Its announcement gave no user loss figure, affected wallet count or attacker address, and it did not identify an intrusion into Hyperliquid's underlying trading infrastructure.
The Trade.xyz restoration time came before the infrastructure access time GitBook disclosed later that day. Neither announcement established that the two incidents shared an attacker or an entry point, and the sources do not show a confirmed link between them.
Why It Matters
For Traders
Traders using Trade.xyz or Hyperliquid-linked tools should watch for official updates before following any documentation links tied to these incidents.
For Investors
The breach shows that third-party documentation and developer tooling can become an attack surface for crypto platforms, a risk that may affect how protocols assess vendors.
For Builders
Teams that embed GitBook integrations or MCP connections should rotate tokens and secrets now and audit whether Assistant questions or Git Sync credentials were stored or shared.
This article is for information only and is not financial advice. Read the full disclaimer.
