GitBook, a widely used developer documentation platform, has disclosed a targeted cyberattack involving artificial intelligence agents, raising concerns about the security of cryptocurrency projects that rely on its infrastructure.The company confirmed on November 3, 2026, that attackers had gained unauthorized access to certain infrastructure credentials at approximately 19:00 Central European Time on November 2. GitBook described the incident as a sophisticated attack using AI agents, although it has not identified the specific AI tools involved or explained precisely how they were deployed.The company temporarily suspended its application and authenticated documentation services while investigating the intrusion. Publicly accessible documentation remained available through cached versions wherever possible.GitBook said its investigation identified potentially exposed API tokens, integration credentials, Git Sync secrets and questions submitted through GitBook Assistant. However, the company reported finding no evidence that attackers had modified customer documentation or other hosted content.
Crypto Projects Respond as GitBook Revokes Access Credentials
The security incident prompted immediate precautions among cryptocurrency projects that use GitBook to publish technical documentation and user guides. Decentralized exchange PancakeSwap temporarily disabled its documentation website after learning about the breach.The project emphasized that its application remained operational and that its documentation had not been compromised. PancakeSwap subsequently restored its documentation after migrating away from GitBook to infrastructure under its own control.The exchange also warned users that legitimate documentation does not require wallet connections or token approvals. Such precautions are significant because malicious modifications to documentation could potentially direct users toward fraudulent websites or unauthorized transactions.GitBook’s investigation has not established that such modifications occurred during this incident. Following the intrusion, GitBook blocked the attacker, addressed identified vulnerabilities and replaced compromised infrastructure credentials. The company also revoked all personal API tokens, requiring customers to generate new credentials.Organizations using third-party integrations were instructed to rotate associated secrets and API keys. Customers connecting AI assistants through GitBook’s Model Context Protocol server must also authenticate their integrations again. These measures are intended to prevent attackers from exploiting credentials that may have been exposed.
AI-Assisted Intrusion Highlights Third-Party Infrastructure Risks
GitBook confirmed that its application, API and published documentation services were restored on November 3, although some functionality could remain degraded during recovery. The company has not disclosed how many customers were affected or whether attackers successfully extracted sensitive information.It has also not identified the perpetrators or established any connection to recent cryptocurrency exchange breaches. The incident highlights the potential risks associated with AI-assisted cyberattacks, particularly when attackers use automated systems to interact with software infrastructure.AI agents can perform sequences of actions across connected tools, potentially accelerating reconnaissance and exploitation attempts. However, GitBook has not published sufficient technical evidence to determine how much autonomy the attacking agents possessed.The breach also illustrates how third-party software providers can create security exposure for cryptocurrency businesses even when their underlying blockchain protocols remain unaffected. Documentation platforms frequently connect to source-code repositories, deployment workflows and external services through privileged credentials.Unauthorized access to those credentials can create risks extending beyond the documentation platform itself. GitBook has pledged to publish a detailed post-incident report explaining the intrusion and its response. For cryptocurrency projects, the immediate priority is replacing potentially exposed credentials and verifying that connected systems remain secure.The incident underscores the importance of monitoring third-party integrations as AI-assisted cyberattacks become an increasingly prominent cybersecurity concern.