GitBook Mandates Token Resets Following AI-Driven Security Breach

The intrusion occurred at 7 p.m. CET, forcing the company to pull its application and documentation services offline for nearly 24 hours. While investigators confirmed that core content remained uncompromised, the attackers potentially accessed integration tokens, Git Sync secrets, and inquiries submitted to the GitBook Assistant. The company stated that it blocked the unauthorized access and patched the underlying vulnerabilities before restoring service.

Users are now required to manually rotate all API tokens and replace secrets used for third-party integrations. Those utilizing the GitBook MCP server must reauthenticate their connections through their organization’s administrator. Although GitBook initially suggested no user action was needed, the severity of the breach necessitated these strict security measures. This incident follows a broader trend identified by Google Threat Intelligence and Mandiant, which recently reported attackers deploying AI-powered frameworks like Hexstrike to exploit unpatched systems and credentials. GitBook plans to release a comprehensive post-mortem report as their investigation into the scope of the exposure continues.