GitBook Discloses AI-Agent Breach of November 2, Orders Token Resets

GitBook Confirms AI-Agent Intrusion

GitBook, a documentation platform widely used by cryptocurrency projects, disclosed on November 3 that an attacker wielding AI agents gained access to some of its infrastructure credentials, forcing the company to pull services offline and order an emergency rotation of customer keys. Its security disclosure dates the unauthorized access to 7 p.m. Central European Time on November 2, or 6 p.m. UTC, and states that systems detected the intrusion immediately and moved to contain it. GitBook characterizes the episode as a sophisticated and highly targeted attack that used AI agents, though it has not explained which AI systems were involved, how the credentials were obtained, or whether its own AI products played any part.

The distinction matters because an AI agent, unlike a chatbot that merely answers prompts, can execute multi-step sequences of actions with limited human supervision, which makes the technology attractive to attackers automating parts of an intrusion. In response, GitBook took its application and every documentation site requiring authentication offline while it secured its infrastructure, keeping publicly available pages reachable through cached copies for as long as possible. Its investigation identified four categories of potentially accessed records: integration tokens, Git Sync secrets that connect documentation to code repositories, API tokens, and the questions visitors submitted to GitBook Assistant. The company said it has found no evidence that any customer content was modified, and it did not disclose how many customers or records were affected.

By a 4:21 p.m. CET update on November 3, the application, API and published documentation were accessible again, although some services may remain degraded during recovery. GitBook says it blocked the attacker, closed the exploited vulnerabilities, replaced its own infrastructure credentials and invalidated customer API tokens, which are revocable platform-issued keys and work differently from a private key. Customers are told to rotate GitBook API tokens, replace third-party tokens and integration secrets, and reauthenticate the Model Context Protocol server, a system that lets AI assistants connect to services such as GitBook. An earlier notice at 1:15 p.m. CET had said no customer action was required, guidance the company later reversed.

PancakeSwap and Trade.xyz Move First

PancakeSwap moved fastest among the crypto projects affected. The decentralized exchange temporarily disabled its documentation after news of the breach broke, redirecting visitors to its homepage while stressing that its own systems were untouched. In a public statement, PancakeSwap said its docs “are not compromised” and that the app is unaffected, reminding users that its documentation never requires wallet transactions because “docs never ask you to connect your crypto wallet or approve tokens.” The exchange subsequently brought its documentation back online on infrastructure under its own control, with existing links continuing to work, a migration away from GitBook completed within hours of the disclosure.

A separate and possibly unrelated documentation incident hit Trade.xyz earlier the same day. The trading platform identified unauthorized activity on its GitBook pages on the morning of November 2 and restored the documentation to its previous state by 9:15 a.m. Eastern time, while advising users to avoid links inside the docs during its investigation, standard guidance against pages built to harvest a wallet address or a malicious signature. That restoration preceded the 7 p.m. CET access window GitBook later disclosed, and neither announcement established that the two incidents shared an attacker or an entry point. The Trade.xyz statement covered its documentation only; it identified no intrusion into the underlying trading infrastructure and gave no user loss figure, affected wallet count or attacker address.

Wider context arrived on October 30, when Google Threat Intelligence Group and Mandiant published research documenting attackers abusing AI-powered security-testing frameworks, including ARTEX, Hexstrike and CAIRN, across real intrusions. Since late August, their incident-response teams had observed agent activity spanning lateral movement between systems, database exploitation and preparation to extract data. The report listed compromised credentials and unpatched systems among the weaknesses such tools exploit, and recommended short-lived credentials, limited permissions and separation between systems.

Docs Sites Sit on a Trusted Path

Documentation portals occupy an unusually trusted position in crypto: they are where users go for official instructions on connecting a wallet or signing a transaction, so any credential theft or tampering there can turn that trust into a phishing channel. PancakeSwap's decision to self-host rather than wait for GitBook's all-clear shows how projects now weigh that risk. The confirmed facts remain narrow: four categories of potentially accessed records, no evidence of modified content, no customer count. GitBook says it is preparing a full post-incident report; until it publishes, the inclusion of Assistant questions among the exposed categories shows that even metadata can support targeting, and that credential rotation, ideally with short-lived keys, is the durable fix. For users, the episode reinforces the standard advice on how to protect your assets: verify you are on official infrastructure before following any instruction.