GitBook Hit by AI Agent Security Breach, Urges Crypto Docs Users to Rotate Keys

Documentation platform GitBook, widely utilized for hosting crypto docs across various blockchain projects, disclosed a security breach carried out by an attacker using AI agents. The incident allowed unauthorized access to infrastructure credentials, leading the company to temporarily shut down services and revoke customer access tokens.

In a formal security disclosure, the platform described the event as a sophisticated attack occurring at 7 p.m. Central European Time on November 2. The intrusion was detected immediately, allowing the team to begin containment protocols. While traditional chatbots merely respond to queries, AI agents can execute sequences of actions and interact with software independently, making them valuable tools for automating cyberattacks.

GitBook has not specified how the tools were used, which AI systems were involved, or how the credentials were compromised. To secure its infrastructure, the company took authentication-requiring sites offline while maintaining cached copies of public documentation where possible. By Tuesday afternoon, core services, including the application, API, and published pages, were restored with potential minor degradations.

Protecting Crypto Docs and API Tokens

The platform's investigation identified several potentially affected areas, including integration tokens, Git Sync secrets linking repositories, and automated API credentials. In response, decentralized exchange PancakeSwap temporarily took its documentation offline as a precaution, stating that its own app and core systems remained unaffected. PancakeSwap later migrated its documentation to its own infrastructure and reminded users that official guides never require wallet transactions or token approvals.

GitBook blocked the attacker, replaced internal credentials, and invalidated customer tokens. Users are advised to rotate existing GitBook API keys, update third-party integration secrets, and re-authenticate any Model Context Protocol servers used to connect external tools.

GitBook suffered an AI-assisted security breach, forcing the platform to revoke customer access tokens.

Why it matters

This incident highlights the growing risks associated with automated cyber threats and the security of centralized infrastructure used by decentralized networks. Because crypto projects rely heavily on documentation platforms for official user guides, disruptions can create temporary confusion and security concerns for participants interacting with digital assets.