GitBook 遭遇利用 AI agents 的高度定向攻击，部分服务一度下线

Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Gitbook Breached 58 points by punchmesan1 hour ago | hide | past | favorite | 16 comments We opened a ticket with support about Gitbook availability issues and got this in reply. We have yet to see any official customer communication or breach notification. Apologies for the formatting, did the best I could as it's a mobile paste. Update: GitBook security incident update Hey <$name>, The GitBook app, the GitBook API, and published docs are available again. A few services may still be degraded as we finish restoring everything to full performance. What happened GitBook has been the target of a sophisticated, highly targeted attack using AI agents. At 19:00 CET, November 2, the attacker gained unauthorized access to some of our infrastructure credentials. We detected the attack immediately and acted swiftly to block further impact. To make sure our infrastructure was fully secure, we then took the GitBook app and authenticated docs sites offline. We kept publicly published content live for as long as possible, using cached data. What we did immediately * Blocked the attacker and closed the vulnerabilities involved * Replaced every credential and secret across our infrastructure * Brought services back only once we were confident they were secure * Invalidated every customer’s API tokens on our platform Your data Our investigation shows that the attacker may have accessed the following: * Git Sync secrets. * GitBook API tokens. * Third-party API tokens used to connect external tools to GitBook. * Questions asked to GitBook Assistant by your site visitors. At this stage, we have found no evidence that any of your content in GitBook was modified. What you need to do now * Rotate any existing GitBook API tokens. We revoked all personal API tokens during the incident. * Rotate any third-party API tokens or secrets you use to connect other tools to GitBook. * If you have published integrations that use secrets, rotate those secrets. * If you use the GitBook MCP server, re-authenticate it. Please contact your GitBook organization’s admin to assist with this process. What we are doing next * Monitoring the situation in case of further attacks. * Introducing further security measures to our platform. * Writing a full post mortem that will be published soon with more detailed information about the incident. * If you have any further questions, please reach out to your account manager or our support team. You can also check status.gitbook.com for updates Thank you for your patience, and we apologize again for the disruption The GitBook team help SamyPesse13 minutes ago | next[–] GitBook’s CTO here We have been dealing with a security attack since yesterday. Our team has been all hands on deck since the start, and we took a large portion of our services offline to prioritize user security. Our service is progressively coming back online (most of it already is), and we are actively monitoring the situation. We’ll continue to actively keep our users updated through emails, Slack, and our status page as we monitor the situation and learn more. reply latchkey9 minutes ago | parent | next[–] After turning on 2FA, the page doesn't update to say it is turned on. It still has a configure button. Reloading the page fixes this. reply gkoberger12 minutes ago | parent | prev | next[–] Good luck... this isn't easy, so best of luck to you and the team. reply altbdoor12 minutes ago | prev | next[–] Mentioned this 5h ago, but this post definitely fleshes out more details. https://news.ycombinator.com/item?id=50351061 reply manytimesaway1 hour ago | prev | next[–] FYI, Gitbook was made by the team behing friendco.de, which they killed without any announcement years ago. reply SamyPesse11 minutes ago | parent | next[–] I’m genuinely sorry the end of friendco.de impacted you. It was 12-13 years ago; the service had little usage at the time, and we probably didn’t handle the end perfectly. I don’t recall exactly, but I can assure you that the team today is more experienced. reply viccis9 minutes ago | parent | prev | next[–] Not really relevant here. reply petecooper1 hour ago | prev | next[–] https://www.gitbook.com/status/security-incident-2026-11-03 reply philipwhiuk17 minutes ago | parent | next[–] It's bizarre they have both this and gitbookstatus.com and they contain different info. reply SamyPesse1 minute ago | root | parent | next[–] We summarized more information on this page from recent learnings, than what has been posted as updates on the status page (https://www.gitbookstatus.com/incidents/01M6FXDDGQRWHMYYWXY2...). reply aliasxneo59 minutes ago | prev | next[–] "GitBook has been the target of a sophisticated, highly targeted attack using AI agents." Add it to the list, I guess. reply nsoam19 minutes ago | parent | next[–] Is this what they mean when they talk about accountability laundering? Oh, you see, we had the best security ever, but they used AI agents, and there's no defence for that, you can't secure a system against those spooky AI agents. reply latchkey12 minutes ago | prev | next[–] One thing that would be appreciated are more details in these sorts of reports. "the attacker gained unauthorized access to some of our infrastructure credentials" How? Which infrastructure? reply punchmesan1 hour ago | prev | next[–] Oof that formatting is rougher than I thought. Will try to clean it up after I'm done reconfiguring gitbook... reply verdverm1 hour ago | parent | next[–] new lines between bullets, only italics available, not markdown reply philipwhiuk1 hour ago | prev[–] This is the public disclosure: https://www.gitbookstatus.com/incidents/01M6FXDDGQRWHMYYWXY2... Note that the summary at the top of https://www.gitbookstatus.com at time of writing does not mention the unauthorized access and the incident details does not mention the contents disclosed above. reply Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact Search: