WORLDTECHBotpress Says Intruder Read Bot Settings in 16 Customer Workspaces
Botpress reported on November 6, 2026 that an attacker exploited a weakness in an internal authentication proxy and used an employee's API credential to view bot configurations in 16 customer workspaces. The company is now telling affected customers to regard every credential stored in those bots as potentially exposed.
How the attacker gained entry
According to the disclosure, probing of the authentication proxy that guards several internal tools began on October 12, 2026. A weakness in how the proxy validated sign-ins then allowed the intruder to get in using sessions that looked as though they belonged to Botpress staff.
From October 13 to October 21, 2026, the intruder could reach those tools and some connected systems. That access exposed customer account information and internal data, including material tied to staff API credentials. The investigation turned up no evidence that any employee's identity-provider account had been taken over.
What was read and what was altered
Between 07:44 and 08:23 UTC on October 21, the intruder used an employee's API credential, together with that employee's administrator rights, to read configurations across 16 workspaces. The employee belonged to those workspaces and held administrator access in each of them.
Weaknesses in the setup flows of some integrations were also exploited, allowing settings for one integration to be changed in each of two other customer workspaces.
Botpress notes that a bot's configuration stores settings for its installed integrations, which may include AI provider API keys, messaging-channel tokens, CRM credentials and similar third-party secrets. Because its logs cannot establish which bots held a valid credential at the moment they were read, the company is asking customers to rotate everything kept there.
Stated motive and what has not been observed
Botpress ascribes the intrusion to an attempt to acquire AI usage for resale on AI black markets. It says the attacker ran a large network of Botpress accounts that consumed AI credits before and during the incident, and that much of the internal activity aimed to keep those accounts running without limits.
The company says it has received no ransom demand and has seen no sign that customer data was published or put up for sale. Its investigation also found no evidence of altered source code, build pipelines or published packages, no access to end-user conversations handled by customer bots, and no storage of full payment card numbers.
Botpress has contacted the owners of the 16 workspaces and of the two workspaces where integration settings were changed, and has provided lists of the affected bots and integrations. For customers it has not contacted directly, the investigation has found no evidence that their bots were read or changed.
Open questions
- Which stored credentials, if any, were valid when the bots were read?
- Will affected customers be able to see that the stolen AI usage was consumed?