GitBook Revokes All Personal API Tokens After Attack

TechFlow reported on November 4 that, according to GitBook's official announcement, its infrastructure credentials were accessed without authorization on November 2. The platform has revoked all personal API tokens and asked users to rotate third-party tokens and keys used to connect other tools.

GitBook said the attack involved AI agents and that attackers may have accessed integration tokens, Git Sync keys, API tokens, and questions submitted by visitors to GitBook Assistant. No evidence has been found that customer content was modified. The company said it has blocked the attacker and remediated the related vulnerabilities; access to its app, API, and published documentation has been restored, although some services may still be affected.

Source: TechFlow