GitBook has urged customers to replace API tokens and integration secrets after a sophisticated, AI-powered cyberattack compromised infrastructure credentials and potentially exposed customer data. The documentation platform, widely used by cryptocurrency and blockchain projects, said unauthorized access occurred at 7 p.m. CET on Nov. 2, 2026, and was detected immediately.
The company's response included taking its application and documentation sites requiring authentication offline while securing infrastructure. Public documentation remained available through cached data where possible. By Nov. 3 at 4:21 p.m. CET, GitBook said its application, API and published documentation were available again, though some services could remain degraded.
GitBook described the intrusion as a highly targeted attack involving AI agents. It blocked the attacker, closed the vulnerabilities involved, and replaced every credential and secret across its infrastructure. All personal API tokens were revoked. The investigation identified four categories of potentially accessed information: integration tokens, Git Sync secrets, API tokens, and questions submitted by documentation visitors to the GitBook Assistant. GitBook said it found no evidence that published content was modified.
Customers have been told to rotate existing GitBook API tokens and replace third-party API tokens or secrets used to connect other tools to GitBook. Users of the GitBook MCP server must reauthenticate their connection. GitBook said it is monitoring for further attacks and preparing a full post-incident report.
Separately, Trade.xyz said it restored its GitBook documentation on the morning of Nov. 2 after identifying unauthorized activity on its pages. The company did not identify an intrusion into Hyperliquid's underlying trading infrastructure and gave no user loss figure. Security researchers from Google Threat Intelligence Group and Mandiant have also documented attackers using AI-powered security-testing frameworks, including ARTEX, Hexstrike and CAIRN, in real intrusions since late August.
