Gitbook Breached

A customer seeking help with GitBook availability received a security update saying the company had been hit by a sophisticated, targeted attack using AI agents. At 19:00 CET on November 2, an attacker gained unauthorized access to some infrastructure credentials. GitBook says it detected the intrusion immediately, blocked further access, and took its app and authenticated documentation sites offline while securing its systems. Publicly published docs remained available using cached data. The app, API, and published documentation have since returned, though some services may still be degraded. The customer who shared the message says they had not seen a separate official customer notification.

GitBook’s investigation found that the attacker may have accessed Git Sync secrets, GitBook API tokens, tokens for connected third-party services, and questions visitors asked GitBook Assistant. The company reports no evidence that documentation content was changed. It says it closed the vulnerabilities, replaced infrastructure credentials and secrets, and revoked customers’ personal API tokens. Customers are instructed to rotate third-party and integration secrets, replace any relevant GitBook API tokens, and reauthenticate the GitBook MCP server with help from an organization admin. GitBook is monitoring for further attacks, adding security measures, and preparing a fuller incident review.