Technical documentation hosting and management platform GitBook restored its services to operational status on November 3, 2026, following a severe security incident that forced an extensive temporary system shutdown. According to an official announcement from the operations team, the platform was targeted in a highly targeted attack campaign that leveraged artificial intelligence agents to compromise infrastructure credentials.

Breach Timeline and Emergency Response Measures

The incident began at 19:00 CET on November 2, 2026, when attackers gained unauthorized access to several credentials within GitBook’s server infrastructure. The security team detected the intrusion as it occurred and immediately isolated the vulnerabilities. To ensure system integrity, GitBook decided to take its primary application and login-required documentation pages offline, while maintaining public content through caching as much as possible.

To completely neutralize any risk of data exposure, GitBook rotated all credentials and secrets across its entire server fleet. At the same time, the platform revoked all customer personal API tokens across the system. By the afternoon of November 3, 2026, the application, APIs, and public documentation pages were operating normally, although some ancillary services continued to experience degraded performance during the full recovery process.

Scope of Affected Data and Required Actions

According to initial investigation findings, the attacker may have accessed four categories of sensitive data: third-party integration authentication tokens, Git Sync repository synchronization secrets, user API tokens, and queries submitted by visitors to the GitBook Assistant AI. As of the time of reporting, the company confirmed that it had found no evidence that documentation content hosted on the system was modified or injected with malicious code.

For users and organizations managing documentation on the platform, GitBook issued urgent recommendations:

  • Regenerate all GitBook API tokens and secret keys used to connect external tools.

  • Update security keys for published custom integrations.

  • Re-authenticate connections if using GitBook Model Context Protocol (MCP) servers.

The incident comes amid a wave of automated threats targeting software infrastructure, echoing warnings from researchers when Claude exploited a Linux kernel vulnerability or urgent security advisories such as the emergency warning for Solana validators regarding infrastructure flaw risks. The breach highlights how the role of automated agents is creating unprecedented defensive pressure for technical documentation and source code infrastructure providers.