The Pulse

Botpress Says Attacker Read Bot Configurations in 16 Customer Workspaces

Botpress says an attacker used an employee’s API credential to read bot configurations in 16 customer workspaces. The company also says integration settings were changed in two other workspaces.

AI.info Team · Written with AI · fact-checked · 2026-11-07

What the Attacker Reached on October 21

Botpress says an attacker used an employee’s API credential to read bot configurations in 16 customer workspaces on October 21. Those configurations included integration settings, which can contain credentials for third-party services, including AI provider API keys, messaging channel tokens, CRM credentials and similar. Separately, the attacker changed settings for one integration in each of two other customer workspaces.

A Flaw in the Authentication Proxy

On October 12, someone began probing the authentication proxy used in front of several internal tools. A flaw in sign-in validation let the attacker enter those tools with sessions that appeared to belong to Botpress staff. Botpress found no evidence that an employee’s account with its identity provider was compromised. Between October 13 and October 21, the attacker had access to internal tools and to some of the systems they connect to. That access gave the attacker visibility into customer account information and internal data related to Botpress staff API credentials.

The Suspected Goal: AI Usage to Resell

Everything Botpress observed points to one goal: obtaining AI usage the attacker could resell on AI black markets. Before and during the intrusion, the attacker ran a large network of accounts on Botpress’s platform to consume AI credits. Much of the activity inside Botpress systems was aimed at keeping those accounts running without limits. Botpress received no ransom demand and has seen no sign that customer data had been published or offered for sale.

The Fix and What Remains Unknown

On October 21, Botpress fixed the vulnerability in its internal authentication proxy, rotated its secret and revoked the employee credential used in the intrusion. The attacker kept trying to regain access through other routes and new platform accounts, but attempts observed through November 3 were rejected. Botpress contacted the owners of the 16 workspaces where bots were read and the two where integration settings changed.

Because its logs cannot show exactly which affected bots held a valid credential at the time, Botpress asked customers to treat every credential stored in them as exposed. Botpress’s investigation so far found no evidence of access to the end-user conversations handled by customer bots. Botpress says it is changing its bot API so a bot’s stored credentials cannot be reached this way again.