Botpress disclosed a security incident on November 6 in which an unauthorized party read bot configurations in 16 customer workspaces. Those configurations can hold AI provider API keys, messaging channel tokens, CRM credentials and similar secrets, and Botpress said the attacker's aim was to obtain AI usage for resale on AI black markets.
The disclosure, written by Botpress CTO Michael Masson, says the intruder got into internal tools through a flaw in the sign-in validation of an authentication proxy that sits in front of several of those tools. Probing began on October 12, 2026, and access ran from October 13 to October 21. Botpress said it found no evidence that any employee's identity-provider account was compromised.
The customer-facing exposure was brief. Between 07:44 and 08:23 UTC on October 21, the attacker used an employee's API credential, and the admin access attached to it, to read bot configurations in the 16 workspaces. Separately, weaknesses in the setup flows of some integrations were used to change one integration's settings in each of two other workspaces.
Key facts
- 01Botpress says an attacker read bot configurations in 16 customer workspaces on October 21, 2026, between 07:44 and 08:23 UTC.
- 02Settings for one integration were changed in each of two more workspaces, bringing the notified total to 18 workspaces.
- 03Entry came through a sign-in validation flaw in an internal authentication proxy, with access running October 13 to October 21.
- 04Botpress attributes the breach to an effort to obtain AI usage for resale on AI black markets.
- 05Botpress says it received no ransom demand and found no evidence of access to end-user conversations or source code.
Botpress has contacted the owners of all 18 affected workspaces and sent them lists of the bots and integrations involved. Those customers are being asked to treat every credential stored in the affected bots as exposed. For everyone else, Masson wrote that the company has no evidence their bots or configurations were accessed.
On motive, Botpress said the attacker ran a large network of accounts that consumed AI credits, and it tied the intrusion to that operation.
“We have received no ransom demand, and we have seen no sign that customer data has been published or offered for sale.”— Michael Masson, Chief Technology Officer, Botpress
Botpress also drew lines around what was not touched. The company said it has no evidence of changes to its source code, build pipelines or published packages, and no evidence of access to end-user conversations. It noted that it does not store full payment card numbers.
Remediation started at about 16:25 UTC on October 21. Botpress fixed the proxy flaw and rotated its secret, revoked the employee credential, blocked the attacker's accounts, workspaces and routes, hardened ingress rules, restricted and restarted the affected tools, reversed the attacker's internal setting changes and strengthened how integration configurations are stored. It also began rotating internal credentials found in files the attacker read.
The attacker did not stop there. Botpress said the party kept trying other routes and new accounts, and that it closed every route it identified. Attempts observed through November 3, 2026, were rejected.
“We're responsible for how our systems are protected, and that includes the internal tools our own team uses every day.”— Michael Masson, Chief Technology Officer, Botpress
Several pieces of work remain open, according to the disclosure: finishing the rotation of internal credentials, a hardening initiative that reviews access to every internal tool and the permissions on staff credentials, including admin access to customer workspaces, and a change to the bot API so stored bot credentials cannot be reached this way again.
Botpress said monitoring continues and that it will keep working with affected customers until their credentials are rotated. Masson closed the post with an apology to customers.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
