For 39 minutes on the morning of October 21, between 07:44 and 08:23 UTC, someone holding a Botpress employee's API credential read the bot configurations in 16 customer workspaces. That's from the disclosure Botpress published on November 6. Separately, they changed one integration's settings in each of two other workspaces.

A bot configuration on Botpress is not a harmless file. As Unite.ai's report puts it, these configs can hold third-party secrets: AI provider API keys, messaging-channel tokens and CRM credentials. Botpress can't tell which bots held a valid credential at the moment they were read, so it is asking affected customers to "treat every credential stored in the affected bots as exposed" (Botpress).

What Botpress says happened

The disclosure opens with the plain version: "an unauthorized party got into some of the internal tools our team uses to run Botpress" (Botpress). The timeline, from the disclosure and Unite.ai, in UTC where Botpress gave a time:

  • October 12: probing starts against the authentication proxy that sits in front of several internal tools.
  • October 13–21: the attacker has access to those tools and some connected systems, with visibility into customer account information and internal data, including data about staff API credentials.
  • October 21, 07:44–08:23: the employee's credential is used to read bot configurations in 16 workspaces.
  • October 21, around 16:25: Botpress fixes the proxy vulnerability, rotates its secret and revokes the employee credential.
  • Through November 3: further attempts to get back in are seen and rejected.
  • November 6: public disclosure.

Unite.ai reports that the attacker used the employee credential together with its administrator access, and that the two integration changes came from weaknesses in some integrations' setup flows (Unite.ai). Botpress doesn't say when those two integration changes happened.

A cream-coloured cabinet shaped like a chatbot head with its door open, rows of small keys hanging inside, and a black silhouetted hand reaching in with a staff lanyard badge
A bot config holds the keys the bot uses. Read the config, and you can read the keys.

What Botpress says was not touched

Botpress lists what its investigation did not find (Botpress):

  • no evidence that any employee's identity-provider account was compromised
  • no evidence of changes to source code, build pipelines or published packages
  • no evidence of access to end-user conversations handled by customer bots
  • full payment card numbers are not stored, so there were none to take

It also says it received no ransom demand and has not seen customer data published or offered for sale. If Botpress hasn't contacted you directly, it says it has no evidence your bots or their configuration were read or changed.

Why a chatbot config is worth breaking into

Botpress's read of the motive is the useful part for anyone who stores AI keys on a platform. The attacker appeared to be after AI usage they could resell, and ran many Botpress accounts to consume AI credits (Botpress, Unite.ai).

That fits a pattern from last month. On October 30, Wiz counted at least nine AI developer platforms that disclosed incidents in October 2026, with attacks hunting stored environment variables and especially the ones that grant AI access. Wiz saw compromised enterprise keys being tested from attacker infrastructure, one cluster of it tied to an LLM resale site, though Wiz says it can't definitively link those resellers to the original compromise. It also wrote that the market for LLM access "makes the theft easily monetizable." Botpress is not on Wiz's list, and nothing in either report ties the Botpress intrusion to the same actor. The incentive is the same, though: a platform that holds many customers' AI keys is a bulk source of credits.

The fix that is still in progress

Botpress says the routes it found are closed, and that its internal tools can no longer be reached with a forged identity (Unite.ai). Two items on its remaining-work list say more than the rest (Botpress):

  • a review of access to internal tools and staff permissions, including when employees should hold admin access to customer workspaces
  • a change to the bot API so stored bot credentials can't be reached this way again

My reading of the second item: on October 21, a staff credential with admin access could get to customers' stored secrets through the bot API. Botpress hasn't described the mechanism in more detail, and the change hasn't shipped yet. Until it does, how far a stolen staff credential could reach depends on that permission review.

The rest of the list is internal credential rotation, including credentials in files the attacker read, continued monitoring, and direct work with affected customers until their credentials are rotated.

What to do with your keys

If Botpress contacted you, it sent the list of bots and integrations involved (Botpress). Work through it in this order:

  1. Rotate at the provider, not in Botpress. Pasting a new value into the bot does nothing if the old key still works. Revoke the old key in the OpenAI, Anthropic or other provider console, the messaging channel and the CRM, then put the new one in the bot.
  2. Check provider usage from October 13 up to the moment you revoked each key. The attacker had access from October 13, and Botpress saw attempts to get back in through November 3, but a key copied out of a config keeps working anywhere until you revoke it.
  3. Check any changed integration. If your list includes one, compare its current settings with what you expect, including any URL it sends data to.

If you weren't contacted, Botpress says it found no evidence your bots were read. This is still a good week to make a leaked key cheaper. Give each bot its own provider key, never a shared org key. On Anthropic's API, put that key in its own workspace: workspaces have their own spend limits, which cap monthly spending and can send alerts at thresholds you set, and their own rate limits per model. A key that can only spend a capped amount in one workspace is worth far less to someone reselling credits.

A large black padlock with a cracked old key being pulled out and a bright burnt-orange key going in, next to a simple gauge with a needle near its limit
Rotate where the key is issued. Then cap what the new one can spend.

The question Botpress left open is the one worth asking every platform that holds your keys: can a staff credential read customers' secrets? Botpress is reviewing that now. Ask your other vendors before they have to.

If this was useful

The spend alert you set this week is also your detector next time: a stolen AI key often shows up as a cost spike on one key before it looks like anything else. Observability for LLM Applications is about watching the cost and quality of LLM features in production, with traces and evals, so a spike like that lands on a dashboard you already watch instead of on an invoice.

I also build Hermes IDE, so weigh this with that in mind: it runs Claude Code, Codex and other agents side by side, and each agent uses its own CLI sign-in, so Hermes never asks for your tokens. It's free and source-available (GitHub).

Observability for LLM Applications — the book