Evidence · DiggingBeagle record
Botpress November 2026 security incident disclosure
An attacker exploited a staff SSO/proxy validation weakness to impersonate Botpress personnel and acquire a privileged employee API credential capable of reading or changing customer bot configurations. Botpress reports configuration reads across 16 workspaces and integration changes in two others during its October investigation. Potentially reachable AI or CRM secrets are not equivalent to confirmed theft of every token or user conversation. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
- Source role
- primary disclosure
Evidence record
An attacker exploited a staff SSO/proxy validation weakness to impersonate Botpress personnel and acquire a privileged employee API credential capable of reading or changing customer bot configurations. Botpress reports configuration reads across 16 workspaces and integration changes in two others during its October investigation. Potentially reachable AI or CRM secrets are not equivalent to confirmed theft of every token or user conversation. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
Claim-level citations (3)
- supportsBotpress staff-session impersonation exposed customer AI bot configurations: Botpress reports configuration reads across 16 workspaces and integration changes in two others during its October investigation. Potentially reachable AI or CRM secrets are not equivalent to confirmed theft of every token or user conversation.
Incident timeline; staff session validation; affected customer workspaces
- supportsBotpress staff-session impersonation exposed customer AI bot configurations: An attacker exploited a staff SSO/proxy validation weakness to impersonate Botpress personnel and acquire a privileged employee API credential capable of reading or changing customer bot configurations.
Incident timeline; staff session validation; affected customer workspaces
- supportsBotpress staff-session impersonation exposed customer AI bot configurations: Botpress reports that the attacker accessed configurations across 16 customer workspaces and altered integrations in two other workspaces during the October 21, 2026 intrusion window from 07:44 to 08:23. That observation does not establish theft of every reachable integration secret.
October 21 timeline, 07:44 to 08:23 and customer-workspace impact