GitBook revokes all personal API tokens following attack

GitBook disclosed that its infrastructure credentials were accessed without authorization on November 2, prompting the platform to revoke all personal API tokens and instruct users to rotate third-party tokens and keys connected to other tools. The company said the attack involved an AI agent and may have exposed integration tokens, Git Sync keys, API tokens, and questions visitors submitted to GitBook Assistant, though it found no evidence that customer content was modified. GitBook said it has blocked the attacker and patched the relevant vulnerabilities, with its app, API, and published documentation restored, while some services may still be affected. The incident matters because it highlights the exposure of integration and sync credentials that link documentation workflows to external tools. What to watch next is whether GitBook provides a fuller scope of affected tokens and whether customers report downstream compromises from rotated keys.