Category: AI Agent Security | Reading time: 3 min
Two developer companies disclosed intrusions this week in which the attackers used AI agents. GitBook, the documentation platform, says a "sophisticated, highly targeted attack using AI agents" reached some of its infrastructure credentials on November 2. WorkOS, which provides sign-in and identity APIs to more than 3,000 companies, says an attacker used an AI offensive security framework to break into an internal sales application on October 30.
GitBook: every customer API token invalidated
According to GitBook's incident notice, the attacker gained unauthorized access to some infrastructure credentials at 19:00 CET on November 2. GitBook says it detected the attack immediately, took the app and authenticated docs sites offline, blocked the attacker, closed the vulnerabilities involved, replaced every credential and secret across its infrastructure, and invalidated every customer's API tokens. The app, API and published docs returned on November 3, and GitBook declared the incident resolved on November 4.
GitBook says the attacker may have accessed integration tokens, Git Sync secrets, API tokens, and questions that site visitors asked GitBook Assistant. It has found no evidence that customer content was modified. Customers are told to rotate GitBook API tokens, rotate third-party tokens and secrets connected to GitBook, rotate secrets in published integrations, and re-authenticate the GitBook MCP server. GitBook has not yet said how the credentials were obtained and has promised a full postmortem.
WorkOS: sales data and customer conversation summaries taken
WorkOS says it identified unauthorized access to an internal application used by its sales team on October 30. The attacker reached business contact details from its CRM, customer account histories, and summaries and excerpts of sales calls, support discussions and customer Slack conversations. WorkOS says no app data or production services were accessed. It disabled external access to the application, reviewed access controls on internal tools, and hired an outside forensics firm.
Founder Michael Grinich said the attacker used the ARTEX AI penetration testing suite, identified through user agents including 'artex-enrich/1.0' and 'norma/0.4' in the attacker's web requests, BleepingComputer reports. ARTEX was released as open source earlier this year, went private after it was used against South Korean banks, and forks remain available.
Why it matters for companies running agents
Both disclosures rely on the phrase "may have accessed." When automated attackers move through credentials and internal tools, the first question from customers and regulators is what each identity actually did, and the answer depends on records made at the time. For organizations deploying their own agents, the same standard is coming: per-agent identity, scoped credentials that can be revoked quickly, and timestamped records of every action that can be shown to outsiders.
Source: GitBook security incident notice, BleepingComputer on WorkOS