Botpress Breach Exposes Customer Bot Credentials to New Risk

A flaw in an internal Botpress authentication proxy opened a path into customer bot configurations, and an employee API credential turned that access into a serious credential risk. Botpress disclosed on November 6, 2026, that an intruder read configurations in 16 customer workspaces and changed integration settings in two additional workspaces.

The company says containment is complete, remediation continues, and customers connected to the affected workspaces should treat every credential stored in affected bots as exposed. That warning matters because bot configurations can hold the keys that connect AI systems to other services.

How the Intruder Reached Customer Workspaces

The activity began on October 12, 2026, when someone started probing the authentication proxy that protected several internal tools. A flaw in the proxy’s sign-in validation allowed the attacker to enter with sessions that appeared to belong to Botpress staff.

From October 13 through October 21, 2026, the attacker accessed those tools and some connected systems while learning how Botpress’s systems worked. That access exposed customer account information and internal data, including information related to staff API credentials.

The investigation found no evidence that an employee’s identity-provider account was compromised. Instead, the attacker used an employee API credential that carried administrator access to the customer workspaces involved.

On October 21, between 07:44 and 08:23 UTC, the attacker used that credential to read configurations in 16 workspaces. The employee belonged to those customer workspaces and held administrator access to them, creating a direct route to the bot settings stored there.

Why Bot Configurations Can Expose More Than Settings

A bot configuration includes settings for installed integrations, and those settings can contain sensitive third-party credentials. The affected data may include AI provider API keys, messaging-channel tokens, CRM credentials and similar secrets.

Botpress knows which bots were read and has contacted the owners of the 16 affected workspaces. It also contacted the owners of two other customer workspaces where integration settings were changed, providing lists of affected bots and integrations.

There is one important limit to the investigation: Botpress’s logs cannot establish exactly which bots contained a valid credential when the attacker read them. The company is therefore asking customers in those workspaces to treat every credential stored in affected bots as exposed.

Separately, weaknesses in some integration setup flows allowed the attacker to change one integration’s settings in each of two other customer workspaces. Those changes occurred outside the 16 workspaces where configurations were read, making the incident affect two distinct groups of customers.

• Configurations were read in 16 customer workspaces.
• Integration settings were changed in two additional customer workspaces.
• Affected configurations may contain AI provider API keys, messaging-channel tokens, CRM credentials and similar third-party secrets.
• Botpress supplied affected bot and integration lists to the contacted workspace owners.
• Customers not contacted directly have no evidence, from the investigation, that their bots were read or changed.

Containment, Investigation and What Remains Unknown

At approximately 16:25 UTC on October 21, Botpress fixed the proxy vulnerability, rotated its secret and revoked the employee credential. It also blocked accounts, workspaces and network routes associated with the attacker, hardened ingress rules, and restricted and restarted affected tools.

Botpress attributes the intrusion to an effort to obtain AI usage for resale on AI black markets. The attacker operated a large network of Botpress accounts to consume AI credits before and during the incident, while much of the internal activity focused on keeping those accounts operating without limits.

No ransom demand has been received, and Botpress has observed no sign that customer data was published or offered for sale. The investigation also found no evidence of changes to source code, build pipelines or published packages.

There is no evidence that the attacker accessed end-user conversations handled by customer bots. Botpress also does not store full payment card numbers, narrowing the types of customer information involved in the disclosure.

For customers who were not contacted directly, the investigation has produced no evidence that their bots were read or changed. Botpress says it will update the disclosure if those findings change.

The incident still leaves customers with a clear action: review every credential stored in an affected bot and treat it as exposed. The company’s response has closed the exploited proxy path and revoked the employee credential, but the credential review will remain central as remediation continues.

Stay connected via Google News

Follow us for the latest AI News