GitBook revokes all personal API tokens after AI-agent breach

In short

• GitBook said on 3 November 2026 that attackers used AI agents to access infrastructure credentials on 2 November.
• All personal API tokens were revoked, and users were told to rotate API tokens, integration secrets and Git Sync keys.
• Attackers may have accessed questions submitted to GitBook Assistant, but GitBook found no evidence that document content was modified.
• Crypto projects using GitBook should check page history for unauthorised changes to links, install commands or wallet addresses.

What GitBook said happened

GitBook said on 3 November 2026 that an attacker gained access to part of its infrastructure credentials on 2 November 2026 in what the company called a 'sophisticated, highly targeted attack using AI agents', according to TechFlow and BlockBeats. GitBook, a documentation platform used widely by crypto projects, revoked every personal API token and told customers to rotate third-party tokens and keys connected to GitBook. The company said some services were temporarily offline while it restored them safely.

Which data may attackers have accessed?

GitBook warned that intruders could have reached Git Sync secrets, its API tokens, third-party tokens that link outside tools to the platform, and questions site visitors put to GitBook Assistant. It said no evidence had emerged that customer content on GitBook had been altered. According to GitBook's own incident update, the breach was a highly targeted operation involving AI agents.

What users should do now

GitBook told users to rotate any existing GitBook API tokens, rotate third-party API tokens or secrets used to connect other tools, rotate secrets in published integrations that contain keys, and re-authenticate the GitBook MCP server, a connector for AI and other tools. Users who run documentation for crypto projects may also want to check page history for unauthorised edits to links, install commands or wallet addresses, since GitBook is heavily used for crypto documentation. The company said it had blocked the attacker, closed the vulnerabilities involved and replaced every credential across its infrastructure.

How the crypto community reacted on X

GitBook (@GitBookIO) said on X that it was addressing a security incident and that some services were temporarily offline. Crypto India (@CryptooIndia), DEGEN NEWS (@DegenerateNews) and The Block (@TheBlockCo) posted the core details, with The Block noting that multiple customers were affected. Community replies focused on leaked Git Sync secrets: Satovinci (@Satovinci) said those secrets are 'scary' if a docs repository also holds deploy keys, and John Rood (@johnroodepic) said a compromised integration can become a whole credential sweep. imercion (@imercion) said half of crypto Twitter runs its docs on GitBook and told users to rotate everything today.

What the GitBook breach means for developers and traders

Developers and traders who use GitBook for documentation or integrations should assume their tokens need replacing and start with the API tokens and third-party secrets GitBook listed. Ordinary users should be cautious about links, install commands and wallet addresses in any crypto documentation in the coming days, especially if a project pushed an 'updated docs' link after the incident. GitBook said it has found no evidence that content was modified, but the situation is still being monitored.

GitBook said it is watching for more attacks, adding extra security safeguards and preparing a detailed post mortem for release shortly. The Defiant (@DefiantNews) reported that PancakeSwap had shifted its documentation onto infrastructure under its own control. GitBook told anyone with further questions to speak to their account manager or the support team, and to watch status.gitbook.com for updates.

Questions readers ask

git sync secrets is the scary line. if your docs sync with a repo that also holds deploy keys or bot configs, rotate those too, not just the GitBook token. half of crypto's docs run on GitBook

Was GitBook hit by a major cyberattack?

Yes. GitBook said on 3 November 2026 that an attacker used AI agents to reach some infrastructure credentials on 2 November 2026. It revoked all personal API tokens and told users to rotate third-party tokens and keys connected to GitBook.

Which GitBook data may have been exposed?

GitBook said the attacker may have accessed Git Sync secrets, GitBook API tokens, third-party API tokens used to connect external tools, and questions visitors asked GitBook Assistant. GitBook said it had found no evidence that customer content was modified.

What should crypto projects using GitBook do now?

GitBook told users to rotate any existing GitBook API tokens, rotate third-party API tokens or secrets used to connect other tools, and re-authenticate the GitBook MCP server. It found no evidence that customer content was modified.

Did attackers change any GitBook documents?

GitBook said it had found no evidence that any customer content in GitBook was modified. The company is still monitoring the situation and has blocked the attacker, closed the vulnerabilities and replaced every credential across its infrastructure.

Our view

At InvestIn.News, we think the most useful response to this incident is operational, not speculative. GitBook's own update makes one thing clear: anyone using the platform for API keys, Git Sync, integrations or the MCP server should rotate those credentials now. The company has already revoked personal API tokens, but third-party secrets remain a user responsibility.

The deeper point is that documentation infrastructure is now critical infrastructure for crypto. GitBook hosts the pages where users copy wallet addresses, install commands and configuration details; an altered page could send funds to the wrong place, even if GitBook found no evidence of content tampering. Projects should treat docs changes with the same care as smart-contract changes.

We will watch for the promised post mortem and for any evidence that customer content was modified. Until then, verified rotation and page-history checks are the concrete steps that reduce risk.

How we reported this: this story draws on reporting by 深潮TechFlow and BlockBeats and 8 public posts shown in the story. Each source is linked in the text and listed under Sources.

Follow the latest on AI NewsFeeds for short updates as the news breaks.

Ishu Aggarwal

What to watch: GitBook plans to publish a full post mortem with more detail, and users are advised to check status.gitbook.com for updates.