Botpress Reveals Internal Breaches and Risks to Customer Credentials – Unite.AI

Botpress disclosed on November 6, 2026, that an intruder used a flaw in an internal authentication proxy and an employee’s API credentials to read bot configurations in 16 customer workspaces. Configurations may contain third-party credentials, and integration settings have been changed in two additional workspaces.

An authentication flaw preceded access to the workspace

On October 12, 2026, someone started probing the authentication proxy that protects several internal tools. A flaw in login validation allowed the attacker to log in with sessions that appeared to belong to Botpress staff. From October 13 to October 21, 2026, the attacker gained access to those tools and some connected systems, using that time to understand how Botpress’ systems worked. The access provided visibility into customer account information and internal data, including staff API credential data. The investigation found no evidence that any employee’s identity provider account was compromised.

On October 21, between 07:44 and 08:23 UTC, the attacker used the employee’s API credentials and administrator access to read configurations in 16 workspaces. The employee was a member of the customer’s workspaces and had administrator access to them. A bot’s configuration includes settings for installed integrations, which may contain AI provider API keys, messaging channel tokens, CRM credentials, and similar third-party secrets. Separately, weaknesses in the configuration flows of some integrations were exploited to change the settings of an integration in each of the other two customer workspaces.

Valid credential exposure cannot be determined

Botpress knows which bots have been read and has contacted the owners of the 16 workspaces and the two where integration settings were changed, providing lists of affected bots and integrations. Its logs cannot determine exactly which bots contained valid credentials at the time of reading. The company then asks such customers to treat any credentials stored on affected bots as exposed. For customers not contacted directly, the investigation produced no evidence that their bots were read or modified.

Botpress attributes the intrusion to an attempt to gain use of AI for resale on AI black markets. The attacker operated a large network of Botpress accounts to consume AI credits before and during the incident, and much of the internal activity was aimed at keeping those accounts operating without limits. No ransom demands were received and no signs were observed that customer data was published or offered for sale.

The investigation also found no evidence of source code changes, build pipelines or published packages, and no evidence of access to end-user conversations handled by customer bots. Botpress does not store full payment card numbers. The information will be updated if these results change.

Containment is complete but cleanup continues

Around 16:25 UTC on October 21, Botpress patched the proxy vulnerability, rotated its secret, and revoked the employee’s credentials. It locked accounts, workspaces, and network locations associated with the attacker, hardened entry rules, restricted and restarted affected tools, and limited how those tools could be accessed. It also reversed changes to internal settings, hardened storage for integration configuration, and began rotating internal credentials found in files read by the attacker.

After that fix, the attacker continued to try to log in via other routes and new platform accounts. Botpress closed every identified route and attempts observed through November 3, 2026 were rejected. The company says internal tools can no longer be accessed with a spoofed identity.

The remaining work extends beyond that containment. Internal credential rotation is still ongoing. A strengthening initiative is reviewing access to all internal tools and permissions related to staff credentials, including when employees should have administrator access to customer workspaces. Botpress is also changing the bot API so that stored bot credentials cannot be accessed again via the same method.

Monitoring of related activity will continue and Botpress will work with affected customers until their credentials are rotated. This leaves a clear divide between the immediate and unresolved phases of the incident: identified access routes have been closed, while credential rotation and decisions about staff access to client workspaces remain unfinished.