Botpress says an attacker read bot configurations, which can hold integration credentials, in 16 customer workspaces

Botpress published a security incident disclosure on November 6, 2026, written by its CTO. It says that on October 12 someone began probing the authentication proxy in front of several of its internal tools. That proxy had a flaw in how it validated sign-ins, and the attacker used it to get into those tools with sessions that appeared to belong to Botpress staff. Botpress says it found no evidence that any employee's identity provider account was compromised.

Between October 13 and October 21, Botpress says, the attacker had access to internal tools and some connected systems, which gave it visibility into customer account information and internal data, including data related to Botpress staff API credentials. On October 21, between 07:44 and 08:23 UTC, the attacker used one employee's credential, and the admin access that employee had as a member of a number of customer workspaces, to read the configuration of bots in 16 workspaces. Botpress says a bot's configuration includes the settings of its installed integrations, which can contain credentials for connected services such as AI provider API keys, messaging channel tokens and CRM credentials. Separately, the attacker used weaknesses in the setup flow of some integrations to change the settings of one integration in each of two other workspaces.

Botpress says it fixed the authentication flaw on October 21 at about 16:25 UTC, revoked the employee credential, and that later attempts it observed through November 3 were rejected. It says everything it observed points to the attacker wanting AI usage to resell, that it has received no ransom demand, and that it has seen no sign that customer data was published or offered for sale. It has contacted the owners of the 16 workspaces and the two changed workspaces with the list of bots and integrations involved. Because its logs cannot show which bots held a valid credential at the time, it asks those customers to treat every credential stored in the affected bots as exposed. If you were not contacted, Botpress says it has no evidence your bots were read or changed.

Our advice, not Botpress's: check the usage dashboards of the AI providers whose keys your bots use for activity you do not recognize, since Botpress says the attacker was after AI usage.