GitBook SSO breach may have exposed customer tokens and documents
GitBook suffered a breach on November 2, 2026, in which an attacker accessed infrastructure credentials. The attacker exploited an SSO login flaw to create an employee session, then used GitHub App and Cloudflare credentials to access production infrastructure. Customer API tokens, integration secrets, documents, and questions entered into the AI assistant may have been exposed, and the company treated all customer data as exposed. GitBook suspended service for approximately 16 hours, rotated credentials, and invalidated customer API tokens.
Key facts
- Affected organization
- GitBook
- Incident type
- Hacking & intrusion
- Occurred / detected
- 2026-11-02
- Scale of damage
- Possible exposure of customer API and integration tokens, Git Sync secrets, documents, and AI assistant questions; approximately 16 hours of service downtime
- Cause / method
- The attacker exploited an SSO login flaw to create an employee session, then used GitHub App and Cloudflare credentials to access production infrastructure
- Location
- United States
Timeline
- An attacker accessed GitBook infrastructure credentials, and service was temporarily suspended.
- The company disclosed a targeted attack using an AI agent and the possible exposure of tokens, secrets, and other data, and revoked personal API tokens.
- Employee impersonation through an SSO login flaw, the route into production infrastructure, and approximately 16 hours of service downtime were revealed.
- Details emerged of the response, including treating all customer data as exposed and rotating credentials.
16 related reports
- Crypto Docs Host GitBook Hit by AI Agent Security Breach, Urges Users to Rotate Keys
- GitBook: an AI-agent attack reached infrastructure credentials
- GitBook Users Told to Rotate API Tokens After AI-Agent Attack
- GitBook Says AI Agents Attacked It: Rotate API Tokens, Git Sync Secrets and Re-Authenticate the MCP Server
- GitBook AI Agent Breach: Rotate Your API Keys Now
- GitBook Says an Attacker Using AI Agents Took Infrastructure Credentials: What to Rotate Now
- Einbruch bei GitBook: Angreifer könnten API-Token und Zugangsdaten erbeutet haben
- GitBook Infrastructure Breach: What Teams With GitBook Tokens and Git Sync Should Do Now
- Hackers Breach GitBook Using AI Agents
- Documentation Service GitBook Discloses Unauthorized Access
- GitBook says an attacker used a flaw in its SSO login flow to act as staff, reached production via a GitHub App and a Cloudflare API key, and could access customer data; it took the platform offline for about 16 hours and revoked all API tokens
- Security incident | November 2026
- GitBook urges token resets after AI-powered cyberattack
- GitBook cyberattack: SSO login flaw led attacker to production secrets
- GitBook says AI-assisted breach exposed tokens and Assistant queries
- GitBook SSO Flaw Led to Intrusion and Exposed Customer Secrets
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.