THE ESSENTIALS IN 30 SECONDS

  • Between October 12 and 21, an attacker exploited a sign-in validation flaw in an authentication proxy guarding Botpress internal tools, then used an employee's API credential.
  • On October 21 the attacker read bot configurations in 16 customer workspaces, which can hold AI provider keys and channel tokens, and changed one integration in each of two other workspaces.
  • Botpress asks affected customers to treat every credential stored in the affected bots as exposed and rotate it; it says the apparent goal was AI usage to resell.

Botpress, which sells a platform for building chatbots and AI agents, published a security incident disclosure on November 6 signed by its chief technology officer, Michael Masson. It says an unauthorized party spent more than a week inside some internal tools in October and ended by reading bot configurations in 16 customer workspaces. Those configurations can contain integration settings with third-party secrets, such as AI provider API keys, messaging channel tokens and CRM credentials.

How the intrusion unfolded

According to Botpress's timeline, probing of an authentication proxy that sits in front of several internal tools began on October 12. A flaw in how the proxy validated sign-ins let the attacker reach those tools with sessions that looked like they belonged to staff; the company says it has no evidence that any employee's identity-provider account was compromised. From October 13 to 21 the intruder explored internal systems and found data related to staff API credentials.

On October 21, between 07:44 and 08:23 UTC, the attacker used one employee's API credential to read bot configurations in 16 customer workspaces where that employee was a member with admin rights. Separately, by abusing weaknesses in integration setup flows, the attacker changed the settings of one integration in each of two other customer workspaces. Botpress says it fixed the proxy flaw and revoked the credential around 16:25 UTC that day, and that further attempts to get back in were blocked through November 3.

What customers are asked to do

Botpress has contacted affected customers with lists of the bots and integrations involved. Because it cannot tell which stored credentials were still valid when they were read, it asks them to treat every credential in those bots as exposed and to rotate it. Customers who were not contacted have no sign of their bots being read or modified, the company says.

Botpress reports no evidence of changes to its source code, build pipelines or published packages, of access to end-user conversations, or of a ransom demand, and says it does not store full card numbers. It does not name the attacker. Its assessment is that the intrusion aimed at obtaining AI usage that could be resold on black markets: the company says the attacker ran a large network of accounts on the platform to consume AI credits.

Some points remain open: the disclosure says customer account information and internal data were visible to the intruder without detailing which. Botpress says it is changing its bot API so stored credentials can no longer be reached this way and is reviewing when employees should hold admin access to customer workspaces.