Key facts
- GitBook described the incident as a sophisticated, highly targeted attack using AI agents and said it detected the intrusion immediately.
- Potentially exposed data includes integration tokens, Git Sync secrets linking documentation to code repositories, and API tokens, GitBook said.
- GitBook said it found no evidence that hosted content was modified and that it replaced its own infrastructure credentials.
- PancakeSwap said its docs and app were not compromised and that its documentation never asks users to connect a wallet or approve tokens.
- GitBook told customers using its Model Context Protocol server to authenticate again.
GitBook, a documentation platform widely used by cryptocurrency projects, said an attacker gained unauthorized access to some of its infrastructure credentials at 7 p.m. Central European Time on November 2. In a disclosure, the company described the incident as a sophisticated, highly targeted attack using AI agents and said it detected the intrusion immediately and moved to contain it.
GitBook has not explained how the attacker used AI tools, which AI systems were involved, or how the credentials were obtained. Its disclosure does not establish that GitBook's own AI products were responsible. The company took its application and documentation sites requiring authentication offline, keeping publicly available documentation reachable through cached copies where possible, and a separate status notice acknowledged downtime affecting published documentation sites and the editor. By Tuesday afternoon, GitBook said its application, API and published documentation were accessible again, though some services could remain degraded during recovery.