Botpress says an attacker read bot configurations in 16 customer workspaces and affected customers should treat stored credentials as exposed

TLDR

• Botpress says an attacker used an employee API credential to read bot configurations in 16 customer workspaces on 21 October.¹
• Affected customers are asked to treat every credential in those bots as exposed; Botpress cannot tell which were valid.¹
• Botpress says the intrusion aimed to obtain AI usage for resale and reports no ransom demand.¹

Botpress, in a post by chief technology officer Michael Masson dated 6 November 2026, says an unauthorised party got into internal tools the team uses to run the platform, obtained the API credential of a Botpress employee and used it to read the configuration of bots in 16 customer workspaces.¹ It says a bot's configuration includes the settings of the integrations installed on it, and that these can contain credentials for connected third-party services, such as AI provider API keys, messaging channel tokens and CRM credentials.¹ Separately, it says the attacker used weaknesses in the setup flow of some integrations to change the settings of one integration in each of two other customer workspaces.¹

Botpress gives this timeline. On 12 October someone began probing the authentication proxy in front of several internal tools, which had a flaw in how it validated sign-ins, and the attacker used it to enter those tools with sessions that appeared to belong to staff.¹ Botpress says it has found no evidence that any employee's account with its identity provider was compromised.¹ Between 13 and 21 October the attacker had access to internal tools and some connected systems, including visibility into customer account information and internal data related to staff API credentials.¹ On 21 October, between 07:44 and 08:23 UTC, the attacker used the employee's credential, and the admin access it carried to workspaces the employee was a member of, to read the bot configurations.¹ Botpress says it fixed the authentication flaw at about 16:25 UTC that day and revoked the credential, and that attempts to get back in through other routes and new accounts, observed through 3 November, were rejected.¹

Botpress says its logs cannot show exactly which of the read bots held a valid credential at the time, so it is asking the owners of the 16 workspaces, and of the two where integration settings were changed, to treat every credential stored in the affected bots as exposed.¹ It says those owners have been sent the list of bots and integrations involved, and that customers it has not contacted directly have no evidence of their bots being read or changed.¹ Its investigation so far has found no evidence of access to employees' identity-provider accounts, of changes to source code, build pipelines or published packages, or of access to end-user conversations handled by customers' bots, and it says it does not store full payment card numbers.¹ It says everything observed points to a single goal, obtaining AI usage the attacker could resell on AI black markets, with a large network of accounts run on the platform to consume AI credits.¹ It reports no ransom demand and no sign that customer data has been published or offered for sale.¹ Work still under way includes rotating internal credentials, reviewing staff access to internal tools and customer workspaces, and changing the bot API so stored bot credentials cannot be reached this way again.¹

Other reports describe a wider run of incidents at AI developer platforms. Wiz said on 30 October that at least nine such platforms had disclosed incidents that month, and that all public reports highlighted targeted exploitation hunting stored environment variables, especially those granting AI access.³ SecurityWeek reported on 4 November that at least a dozen AI developer platforms had been hit over the past month, that hackers appeared to be hunting AI access tokens they could monetise, and that the attacks did not appear to be related.² Neither report mentions Botpress, and Botpress's post does not link its incident to them.¹²³ Everything about the incident itself rests on Botpress's own post; no independent outlet was found.¹

Why it matters: bot configurations on the platform can hold keys for connected AI, messaging and CRM services, and Botpress says it cannot tell which credentials in the bots that were read were valid, so it is asking affected customers to treat all of them as exposed.¹