GitBook, the documentation platform behind docs sites of many crypto projects, disclosed a targeted attack using AI agents that gave an attacker access to some of its infrastructure credentials on November 2. The company says it detected the intrusion immediately and found no evidence that hosted content was modified.

Potentially exposed data includes API tokens, integration tokens, Git Sync secrets linking docs to code repositories, and questions submitted to GitBook's AI assistant. GitBook has not said how the AI agents were used or how the credentials were obtained.

GitBook revoked personal API tokens and asked customers to rotate keys, replace third-party integration secrets and re-authenticate its MCP server.

PancakeSwap briefly took its docs offline as a precaution, stating its app was not affected, then moved documentation to infrastructure under its own control. Since many projects publish official instructions on GitBook, users should treat any docs page asking to connect a wallet or approve tokens as a phishing risk.