GitBook said on Nov. 3 it had revoked all personal API tokens after a Nov. 2 breach of its infrastructure, and urged customers to replace secrets used to connect other services to its documentation platform.
In its disclosure, GitBook said the attacker may have accessed integration tokens, Git Sync secrets, API tokens and questions visitors submitted to GitBook Assistant. It said it had found no evidence that customer content had been modified.
Customers were instructed to rotate third-party API tokens and secrets connecting other tools to GitBook, replace secrets used in published integrations, and re-authenticate the GitBook MCP server.
GitBook described “a sophisticated, highly targeted attack using AI agents,” but did not explain how the agents were used or how the attacker obtained the credentials. It placed the unauthorized access to infrastructure credentials at 1 p.m. ET on Nov. 2.
The company said it had blocked the attacker, closed the vulnerabilities involved and replaced every credential and secret across its infrastructure. It took its app and authenticated documentation sites offline, while keeping public content live using cached data for as long as possible.
GitBook said its app, API and published documentation were available again in its Nov. 3 update, while warning that a few services might still be degraded.
Crypto Teams Restrict Documentation
Hyperliquid-based trading platform Trade.xyz said on Nov. 2 that it had identified unauthorized activity affecting its GitBook documentation that morning and restored it to its previous state by 9:15 a.m. ET.
“As a precaution, we advise users not to click on any links within the documentation while our investigation remains ongoing,” Trade.xyz said.
https://x.com/i/status/2117270210449183031
That restoration time precedes the infrastructure-access time in GitBook’s disclosure. The statements do not establish whether the incidents are connected.
Unit said it had temporarily suspended access to its own GitBook page as a precaution following the unauthorized access to Trade.xyz’s documentation. It also advised users not to click documentation links while its investigation continued.
Decentralized exchange PancakeSwap said its documentation was not compromised and its app was unaffected, but took its docs offline as a precaution. On Nov. 3, it said it had moved the documentation off GitBook to infrastructure it controls, with existing links still working.
GitBook said it would publish a full post-mortem with more detailed information about the incident.