GitBook's attacker used AI agents to reach its credentials

Two infrastructure providers lost control of their production systems inside the same 48 hours, and in both cases the tooling reported on the other side was agentic.

GitBook said an attacker using AI agents reached some of its infrastructure credentials on November 2, and the response was the expensive kind: authenticated sites taken offline, customer API tokens revoked, and users told to go and rotate their Git Sync and integration secrets themselves (Decrypt). Chainstack disclosed that an unauthorized party reached its production systems and exposed customer account data and password hashes, a breach the blockchain infrastructure provider is reported to link to a suspected AI-powered attack campaign (The Hacker News).

What got reached was access, not code

Neither disclosure turns on a clever exploit. What moved in both was access: infrastructure credentials at GitBook, account data and password hashes at Chainstack. The patch OpenAI shipped the same week has the same shape. A flaw reported by Parameter Labs could have let an attacker escape a user's ChatGPT sandbox and take over other accounts (Risky Business). The ledger's record puts ChatGPT at 900 million weekly active users as of March 2026 (OpenAI), which is the figure that decides whether a cross-account escape is a bug report or an incident.

Disclosure volume is not exploitation

IBM X-Force counted a 578% rise in vulnerability disclosures across Microsoft, Oracle, Google Chrome and Apache, and attributes it to AI tooling compressing the time it takes to find serious bugs (IBM). That is a measurement of discovery, and today's record carries its own counterweight: Singapore said it has no evidence that the recently disclosed PHP vulnerabilities were exploited in government or critical information infrastructure systems (AsiaOne). Finding more bugs faster is not the same event as more of them being used, and the two numbers should not be read as one trend.

What has clearly not accelerated is the other half, the part that ships fixes to machines. Google's Android 17 is installed on under 1% of Android devices four months after release, while the year-old Android 16 still leads the installed base at 25% (Risky Business). Whatever the discovery curve does, that is the rate at which a fix actually arrives.

The only governance answer on today's record

Snowflake opened its Expedition 2026 conference with two products aimed squarely at agent access: Cortex AI Gateway, which puts every agent's model calls, tool use and spending under one set of policies with hard budget caps, and Business Ontology, which serves agents only the business definitions an accountable owner has approved (Snowflake).

That is a control plane for an organisation's own agents, which is a different problem from defending against someone else's. It is worth noting anyway, because it is the only item today that treats agent access as something to be governed in advance rather than revoked afterwards. GitBook's remediation list is the same problem handled in the other order.

The day's plainest illustration involves no AI at all. Attackers are re-registering expired eSIMs tied to leaked vehicle identification numbers to seize master accounts on Li Auto cars imported into Russia, locking doors and engines and demanding about $500 to $600 for the new digital key, with at least 20 owners confirming hijacks (Risky Business). No model, no exploit chain: just an account that happens to also be a control plane, and nobody checking who holds it.