By Hamza Faisal
Chatbot platform Botpress has disclosed a security breach in which an attacker exploited a flaw in an internal authentication system, stole a staff member's API credential, and read the configuration of bots in 16 customer workspaces — configurations that can hold third-party secrets such as AI provider keys and messaging tokens.
The company published its disclosure on November 6. The intruder had been probing an authentication proxy protecting several internal tools since October 12, and found a flaw in how the proxy validated sign-ins. That flaw let the attacker enter the tools with sessions that appeared to belong to Botpress staff. Botpress said it found no evidence that any employee's identity-provider account was compromised.
On the morning of October 21, between 07:44 and 08:23 UTC, the attacker used the employee's API credential — which carried administrator access to a number of customer workspaces — to read bot configurations in 16 of them. Integration settings were also changed in two additional workspaces.
What was exposed — and what was not
A bot configuration on Botpress is more than a settings file. It can contain third-party credentials, including AI provider API keys, messaging-channel tokens and customer-relationship-management credentials. Botpress said its logs cannot establish exactly which bots held a valid credential at the moment they were read, so it is asking affected customers to treat every credential stored in those bots as exposed.
The company said it knows which bots were read and has contacted the owners of the 16 workspaces, plus the two where integration settings were changed, with lists of the affected bots and integrations. For customers it has not contacted directly, the investigation found no evidence that their bots were read or changed.
Botpress also said there is no evidence that end-user conversations were accessed, and that it does not store full payment card numbers. The two integration changes came from weaknesses in some integrations' setup flows, according to reporting on the disclosure.
The target was AI credits
Botpress attributed the intrusion to an effort to obtain AI usage for resale on underground markets. The attacker operated a large network of Botpress accounts to consume AI credits before and during the incident — a reminder that AI compute itself has become a target for theft, not just the data around it.
The company fixed the proxy vulnerability on October 21 at about 16:25 UTC, rotated its secret and revoked the employee credential. The attacker kept trying to get back in through other routes and new platform accounts, but Botpress said it closed every route it identified, and attempts observed through November 3 were rejected. Its internal tools can no longer be reached with a forged identity, the company said, and internal credential rotation is still underway.
A wider pattern across AI platforms
The Botpress disclosure lands amid a run of incidents at AI developer platforms. Security firm Wiz counted at least nine AI developer platforms that disclosed incidents in October 2026 alone — a sign of how quickly these services, which sit between companies and the AI models they use, have become attractive targets.
For Botpress customers, the practical advice is straightforward: anyone contacted by the company should rotate every credential stored in the affected bots, including AI provider keys and messaging tokens, even if there is no sign the credential was used. For the wider industry, the incident is another warning that the tools companies use to run their AI systems need the same scrutiny as the models themselves.
