GitBook says an attacker may have accessed customer API tokens, integration tokens and Git Sync secrets, and asks customers to rotate them

GitBook published a security incident notice on November 3, 2026. It says GitBook was the target of "a sophisticated, highly targeted attack using AI agents", and that at 19:00 CET on November 2 the attacker gained unauthorized access to some of its infrastructure credentials. That is 10 AM PT. GitBook says it detected the attack right away, took the GitBook app and authenticated docs sites offline, and kept public docs live from cached data for as long as it could.

The notice says GitBook blocked the attacker, closed the vulnerabilities involved, replaced every credential and secret across its infrastructure, and invalidated every customer's API tokens on the platform. It says the attacker may have accessed integration tokens, Git Sync secrets, API tokens, and questions asked to GitBook Assistant by site visitors. GitBook says it has found no evidence that customer content in GitBook was modified.

GitBook asks customers to rotate any existing GitBook API tokens, since it revoked all personal API tokens during the incident. It also asks them to rotate third-party API tokens or secrets used to connect other tools to GitBook, to rotate secrets in published integrations that use them, and to re-authenticate the GitBook MCP server. Git Sync connects a GitBook site to a GitHub or GitLab repository. Our advice, not GitBook's: if you gave Git Sync a token from the repository side, revoke that token where it was issued and create a new one as well. GitBook's notice does not say that disconnecting Git Sync revokes a token it was given.

GitBook's November 4 update says the incident is resolved and functionality is restored, except Git Sync, which an unrelated GitHub outage was still affecting. It says GitBook will publish a full postmortem within 24 hours, with a timeline and the steps it is taking to prevent similar incidents.