Botpress breach exposes AI keys from 18 customer workspaces

The incident began on October 12, 2026, when someone started probing the authentication proxy that protects several of Botpress's internal tools. A flaw in sign-in validation let the attacker in with sessions that appeared to belong to staff through October 21, 2026, giving visibility into customer account information and internal data, including staff API credentials. On October 21 between 07:44 and 08:23 UTC, the employee credential's administrator access was used to read configurations in 16 customer workspaces.

Botpress attributes the intrusion to an effort to obtain AI usage for resale on AI black markets, noting the attacker operated a large network of Botpress accounts to consume AI credits before and during the incident. The company says it has found no evidence that source code, build pipelines or published packages were changed, and no ransom demand has been received.

Containment came at approximately 16:25 UTC on October 21, when Botpress fixed the proxy vulnerability, rotated its secret and revoked the employee credential. The attacker kept attempting access through other routes afterward; Botpress says attempts observed through November 3, 2026 were rejected. Remaining work includes internal credential rotation and a review of when employees should hold administrator access to customer workspaces.