Botpress has disclosed a security breach in which an intruder exploited a flaw in an internal authentication system, stole a staff member’s API credential and read the configuration of bots in 16 customer workspaces. The AI agent platform said the exposed configurations can contain credentials for third-party services, including AI provider API keys, messaging channel tokens and CRM logins.
The disclosure, published on November 6 and signed by chief technology officer Michael Masson, covers an intrusion that began in October and was fixed on October 21. Botpress said it has contacted every affected customer and asked them to treat all credentials stored in the affected bots as exposed.
“You trust us with your bots and with the credentials that power them, and this incident fell short of what you expect from us,” Masson wrote in the disclosure. “We’re taking the steps needed to earn back your trust.”
What happened
According to Botpress, the attack began on October 12, when someone started probing the authentication proxy that sits in front of several of the company’s internal tools. A flaw in how the proxy validated sign-ins let the attacker enter with sessions that appeared to belong to Botpress staff. The company said it found no evidence that any employee’s account with its identity provider was compromised.
Between October 13 and October 21, the attacker had access to those internal tools and some of the systems connected to them. Botpress said the attacker used that time to learn how its systems worked and gained visibility into customer account information and internal data, including data related to staff API credentials.
The decisive step came on the morning of October 21, between 07:44 and 08:23 UTC. In that 39-minute window, the attacker used one employee’s API credential, and the admin access that came with it, to read the configuration of bots in 16 customer workspaces. Separately, the attacker used weaknesses in the setup flow of some integrations to change the settings of one integration in each of two other workspaces.
Botpress fixed the authentication vulnerability on October 21 at about 16:25 UTC, rotated the proxy’s secret and revoked the employee credential. The attacker kept trying to get back in through other routes and new platform accounts, but Botpress said every attempt it observed through November 3 was rejected.
What the attacker was after
Botpress said the evidence points to a single goal: obtaining AI usage that the attacker could resell on AI black markets. Before and during the intrusion, the attacker ran a large network of accounts on the platform to consume AI credits, and much of the activity inside Botpress systems was aimed at keeping those accounts running without limits.
“Everything we’ve observed points to a single goal: obtaining AI usage that the attacker could resell on AI black markets,” the company said in its disclosure. Botpress added that it received no ransom demand and has seen no sign that customer data has been published or offered for sale.
What was and was not affected
Botpress said it knows exactly which bots were read on October 21 and has contacted the owners of the 16 workspaces, and of the two workspaces where integration settings were changed, giving each a list of the bots and integrations involved. What it cannot tell from its logs is exactly which of those bots held a valid credential at the time they were read, so it is asking affected customers to treat every credential stored in the affected bots as exposed.
Customers who were not contacted have no evidence their bots were read or changed, according to the company. Botpress also said its investigation found no evidence of access to end-user conversations handled by customer bots, no changes to its source code, build pipelines or published packages, and no evidence that any employee identity-provider account was compromised. The company noted that it does not store full payment card numbers.
What Botpress has done
Alongside the October 21 fix, Botpress blocked the accounts, workspaces and network routes associated with the attacker and hardened its ingress rules. It restricted and restarted the affected internal tools, limited how they can be reached, reversed the changes the attacker made to internal settings, strengthened how integration configuration is stored and started rotating the internal credentials that appeared in the files the attacker read.
Looking ahead, the company said its internal tools can no longer be reached with a forged identity, and it is changing the bot API so a bot’s stored credentials cannot be reached this way again. An internal hardening initiative is now reviewing access to every internal tool and the permissions of staff credentials, including when Botpress employees should hold admin access to customer workspaces.
Why it matters
The incident is a reminder that the risk in AI agent platforms is not only the model. Botpress customers connect their bots to paid AI services, messaging channels and business systems, so a bot’s configuration is effectively a bundle of live credentials. One stolen staff credential, combined with admin access to customer workspaces, was enough to put those credentials within reach.
The case also shows how AI usage itself has become a target. The attacker was not after customer data to publish or ransom, according to Botpress, but after computing power to resell. As AI credits become a tradeable commodity, platforms that meter and resell that usage are becoming attractive targets in their own right, and the internal tools that administer them need the same protection as the customer-facing product.
