GitBook said attackers used AI agents in a highly targeted attack that obtained some of its infrastructure credentials at 2 a.m. Beijing time on Nov. 3. Potentially exposed information included integration tokens, Git Sync keys, API tokens and questions submitted by website visitors to GitBook Assistant. The company said it had found no evidence that customer content was altered. GitBook revoked all personal API tokens, replaced all credentials and restored related services at 11:21 p.m. Beijing time on Nov. 3. It advised users to rotate GitBook and third-party API tokens and keys and to reauthenticate GitBook MCP servers.