GitBook Security Incident: Infrastructure Breach and Token Compromise

Incident Overview

GitBook has confirmed a security incident involving unauthorized access to its infrastructure credentials, which occurred on November 2 at 19:00 CET. The company reported that the attack was highly targeted and utilized AI agents to bypass security measures. In response, GitBook took its application, API, and authenticated documentation sites offline to contain the threat and secure its environment.

Impact on Customer Data and Credentials

The breach resulted in the potential exposure of sensitive credentials and user data. GitBook’s investigation indicates that the attacker may have accessed:

  • Git Sync secrets
  • GitBook API tokens
  • Third-party API tokens used for external tool integrations
  • Queries submitted to the GitBook Assistant by site visitors

GitBook has stated that there is currently no evidence that user content hosted on the platform was modified during the attack.

Required User Actions

To mitigate the impact of the leaked credentials, GitBook has invalidated all personal API tokens. Users and administrators must take the following steps to secure their accounts:

  • Rotate API Tokens: Generate new GitBook API tokens to replace the invalidated ones.
  • Rotate Third-Party Secrets: Update all third-party API tokens or secrets used to connect external tools to the GitBook platform.
  • Re-authenticate Integrations: If using the GitBook MCP server, users must re-authenticate the service.
  • Review Integrations: Organizations should review all published integrations that utilize secrets and perform a full rotation of those credentials.

Response and Ongoing Monitoring

GitBook CTO Samy Pesse confirmed that the team has been working to restore services and prioritize user security. The company has replaced all infrastructure credentials and secrets and is currently monitoring the platform for signs of further activity. While services have been progressively restored, GitBook has promised a forthcoming post-mortem report to provide more technical detail regarding the attack vector.

Community Feedback and Transparency Concerns

Discussions surrounding the incident have highlighted concerns regarding the transparency of the disclosure process. Some users noted discrepancies between the detailed information provided in support tickets and the initial summaries posted on the official status page. Observers have also requested more granular technical details regarding the specific infrastructure components compromised and the methodology behind the "AI agent" attack vector.

"One thing that would be appreciated are more details in these sorts of reports. 'the attacker gained unauthorized access to some of our infrastructure credentials' How? Which infrastructure?" — Hacker News user latchkey

Users are encouraged to monitor the official GitBook status page for ongoing updates and the final incident report.

Sources