GitBook, a documentation platform widely adopted by cryptocurrency projects, reported a sophisticated breach on November 2 that leveraged AI agents to gain unauthorized access to internal credentials. The intrusion, detected at 7 p.m. CET, forced the company to take its application and documentation sites offline, revoke personal API tokens, and advise customers to rotate all connected keys.

How the AI‑agent attack unfolded

According to Decrypt, the attacker used autonomous AI agents capable of executing sequences of actions across software systems, a step beyond conventional chatbots. While GitBook did not disclose which AI models were employed, it confirmed that the agents accessed integration tokens, Git Sync secrets and API keys that link documentation to external services. The company emphasized that no hosted content appears to have been altered, but the exposure of these credentials could allow downstream services to be compromised if not refreshed.

Immediate response and remediation

GitBook’s incident response included taking its authenticated services offline, replacing its own infrastructure credentials, and invalidating all customer API tokens. Users were instructed to generate new tokens and replace third‑party secrets used with GitBook’s Model Context Protocol (MCP). Public documentation remained accessible via cached copies, allowing readers to continue viewing static pages while the backend was secured.

Impact on crypto projects and industry reaction

The breach quickly affected several crypto projects that host their developer guides on GitBook. PancakeSwap, a decentralized exchange, temporarily disabled its documentation and redirected users to its homepage, stating that neither its app nor its docs were compromised. The exchange later restored its documentation after migrating it to an internally controlled platform, assuring users that the docs never request wallet connections or token approvals. Other projects have been urged to rotate keys and audit any integrations that relied on the exposed tokens.

What to watch next

Observers will monitor whether additional crypto platforms using GitBook disclose further credential exposure, and whether any downstream services experience unauthorized activity linked to the stolen tokens. GitBook has pledged to investigate the specific AI tools used and to improve safeguards against autonomous agent attacks, a development that could shape broader security practices for cloud‑based documentation services.