AI Breach Hits Crypto Docs; Rotate Keys Immediately

Crypto Documentation Platform GitBook Discloses AI-Agent Breach, Tells Users to Rotate Tokens

GitBook, a documentation platform used by many cryptocurrency projects to publish official docs, has disclosed a security breach it says involved “a sophisticated, highly targeted attack using AI agents.” The incident led GitBook to temporarily shut down services and revoke customer access tokens while it contained the intrusion.

In a security disclosure published today, GitBook said the attacker gained unauthorized access at 7 p.m. Central European Time on Nov. 2. The company said it detected the intrusion immediately and moved to contain it.

GitBook’s investigation found that the attacker was able to access some infrastructure credentials. The potentially affected categories include integration tokens, Git Sync keys used to connect GitBook documents with code repositories, and GitBook API tokens that allow software to communicate automatically with GitBook.

As part of its response, GitBook revoked customer access tokens and reset credentials, steps that can disrupt integrations and automated workflows but limit the risk of continued unauthorized access.

The company’s guidance to customers begins with a clear instruction: rotate any existing GitBook API tokens. In practice, that means replacing older digital access keys with newly generated ones to ensure previously issued tokens can’t be reused.

The incident quickly rippled through crypto teams that rely on GitBook to host critical public-facing resources. Some projects, including PancakeSwap, temporarily took down their documentation pages as a precaution, reflecting how central documentation sites are for distributing official information such as product details and integration instructions.

GitBook said it has patched the vulnerability tied to the breach. The episode underscores a growing security challenge for crypto infrastructure providers: as AI tooling becomes more common across software workflows, platforms may face new forms of targeted attacks that require rapid containment and broad credential resets.

• What happened: GitBook reported an AI-agent-linked intrusion that enabled access to certain infrastructure credentials.
• Immediate impact: Service shutdowns and revocation of customer access tokens to contain risk.
• Who’s affected: Users with potentially exposed integration tokens, Git Sync keys, and API tokens.
• What to do: Rotate GitBook API tokens and replace any impacted credentials.