We have been dealing with a security attack since yesterday. Our team has been all hands on deck since the start, and we took a large portion of our services offline to prioritize user security.
Our service is progressively coming back online (most of it already is), and we are actively monitoring the situation.
We’ll continue to actively keep our users updated through emails, Slack, and our status page as we monitor the situation and learn more.
it is sort of funny to see this on a post submitted by a gitbook user that starts off by saying "We have yet to see any official customer communication or breach notification.", and where the company's status page (https://www.gitbookstatus.com/incidents/01M6FXDDGQRWHMYYWXY2...) doesn't mention the customer data that was potentially accessed by the attackers or mention that credentials/tokens should be rotated.
in fact, that status page (which is linked to at the top of the gitbook site) still says "You don’t need to do anything right now."
With the spate of attacks on infra providers over the past few weeks, it's been interesting to see how different competitors respond. The confidence some of the founders seem to have that they won't/can't be next is telling.
> GitBook has been the target of a sophisticated, highly targeted attack using AI agents
Serious question: How do you know it was using AI agents? What logs distinguish it from a human?
I see this claim a lot and while I don't doubt AI is being used for this, I have a hard time believing every breach has a smoking gun showing it to be an AI assisted attack.
My guess is the speed of exfiltration/exploration of the environment is probably impossible for a human, or even a small team. But I'm also curious what their evidence is.
Is this what they mean when they talk about accountability laundering?
Oh, you see, we had the best security ever, but they used AI agents, and there's no defence for that, you can't secure a system against those spooky AI agents.
This is not what we meant. We will be accountable and will post a complete post-mortem. But it’s important to understand that the attack was a lot more developed than what we’ve been used to with humans, especially in terms of pace and adaptability.
For a lot of places, handling this kind of incident response was "eating your vegetables" preparation that has just in the last couple of months turned into "for me it was Tuesday"...
Note that the summary at the top of https://www.gitbookstatus.com at time of writing does not mention the unauthorized access and the incident details does not mention the contents disclosed above.
GitBook’s CTO here
We have been dealing with a security attack since yesterday. Our team has been all hands on deck since the start, and we took a large portion of our services offline to prioritize user security.
Our service is progressively coming back online (most of it already is), and we are actively monitoring the situation.
We’ll continue to actively keep our users updated through emails, Slack, and our status page as we monitor the situation and learn more.
Nice to see someone not fucking up outreach during a security incident.
Good work.
Did you read the body of this post?
>Nice to see someone not fucking up outreach
it is sort of funny to see this on a post submitted by a gitbook user that starts off by saying "We have yet to see any official customer communication or breach notification.", and where the company's status page (https://www.gitbookstatus.com/incidents/01M6FXDDGQRWHMYYWXY2...) doesn't mention the customer data that was potentially accessed by the attackers or mention that credentials/tokens should be rotated.
in fact, that status page (which is linked to at the top of the gitbook site) still says "You don’t need to do anything right now."
Good luck... this isn't easy, so best of luck to you and the team.
Classy response.
With the spate of attacks on infra providers over the past few weeks, it's been interesting to see how different competitors respond. The confidence some of the founders seem to have that they won't/can't be next is telling.
After turning on 2FA, the page doesn't update to say it is turned on. It still has a configure button. Reloading the page fixes this.
> GitBook has been the target of a sophisticated, highly targeted attack using AI agents
Serious question: How do you know it was using AI agents? What logs distinguish it from a human?
I see this claim a lot and while I don't doubt AI is being used for this, I have a hard time believing every breach has a smoking gun showing it to be an AI assisted attack.
My guess is the speed of exfiltration/exploration of the environment is probably impossible for a human, or even a small team. But I'm also curious what their evidence is.
Maybe there was a level-of-stupidity tip-off, like trying to break in and access something that's already public...
Good that they rotated all the tokens themselves instead of just telling users to do it, seen too many incidents where that step gets skipped.
https://www.gitbook.com/status/security-incident-2026-11-03
It's bizarre they have both this and gitbookstatus.com and they contain different info.
We summarized more information on this page from recent learnings, than what has been posted as updates on the status page (https://www.gitbookstatus.com/incidents/01M6FXDDGQRWHMYYWXY2...).
Does a security incident page really need to connect to 11 3rd party domains. smh
"GitBook has been the target of a sophisticated, highly targeted attack using AI agents."
Add it to the list, I guess.
Is this what they mean when they talk about accountability laundering?
Oh, you see, we had the best security ever, but they used AI agents, and there's no defence for that, you can't secure a system against those spooky AI agents.
This is not what we meant. We will be accountable and will post a complete post-mortem. But it’s important to understand that the attack was a lot more developed than what we’ve been used to with humans, especially in terms of pace and adaptability.
For a lot of places, handling this kind of incident response was "eating your vegetables" preparation that has just in the last couple of months turned into "for me it was Tuesday"...
Mentioned this 5h ago, but this post definitely fleshes out more details.
https://news.ycombinator.com/item?id=50351061
This is the public disclosure: https://www.gitbookstatus.com/incidents/01M6FXDDGQRWHMYYWXY2...
Note that the summary at the top of https://www.gitbookstatus.com at time of writing does not mention the unauthorized access and the incident details does not mention the contents disclosed above.
Oof that formatting is rougher than I thought. Will try to clean it up after I'm done reconfiguring gitbook...
new lines between bullets, only italics available, not markdown
One thing that would be appreciated are more details in these sorts of reports.
"the attacker gained unauthorized access to some of our infrastructure credentials"
How? Which infrastructure?
We’ll provide details in a long post-mortem. For now, it was important to notify our users as early as possible.