Botpress Breach Exposed Credentials Across 16 Customer Workspaces

An attacker read bot configurations in 16 Botpress customer workspaces on October 21, 2026, using a stolen employee API credential with administrator access, the company disclosed on November 6. Those configurations can hold third-party secrets — AI provider API keys, messaging-channel tokens, CRM credentials — and Botpress cannot confirm which of them actually did at the moment they were read.

How the intrusion unfolded

On October 12, 2026, someone began probing the authentication proxy that protects several Botpress internal tools. A flaw in its sign-in validation let the attacker enter with sessions that appeared to belong to Botpress staff.

From October 13 through October 21, the attacker had access to those tools and some connected systems, using that time to understand how Botpress's systems worked. The access exposed customer account information and internal data, including material related to staff API credentials. The investigation found no evidence that any employee's identity-provider account itself was compromised.

The payload came on October 21, between 07:44 and 08:23 UTC. The attacker used the employee's credential and its administrator rights — the employee was a member of those 16 workspaces — to read their bot configurations. Separately, weaknesses in some integrations' setup flows were exploited to change one integration's settings in each of two additional customer workspaces.

What does this change for affected customers?

The practical question is credential exposure. Botpress's logs cannot establish which bots contained a valid credential when they were read, so the company is asking contacted customers to treat every credential stored in affected bots as exposed. That's 18 workspaces in total — 16 with read configurations, two with altered integration settings — and each owner has received lists of affected bots and integrations. For customers not contacted directly, the investigation has produced no evidence their bots were read or changed.

Why Botpress thinks it happened

Botpress attributes the intrusion to an effort to obtain AI usage for resale on AI black markets. The attacker operated a large network of Botpress accounts to consume AI credits before and during the incident, and much of the internal activity aimed to keep those accounts operating without limits. No ransom demand has arrived, and the company has seen no sign that customer data was published or offered for sale.

The blast radius looks contained in other respects. The investigation found:

• No evidence of changes to source code, build pipelines or published packages
• No evidence of access to end-user conversations handled by customer bots
• No full payment card numbers at risk, since Botpress doesn't store them

Botpress says the disclosure will be updated if these findings change.

Containment is done, remediation isn't

At roughly 16:25 UTC on October 21 — hours after the workspace reads — Botpress fixed the proxy vulnerability, rotated its secret and revoked the employee credential. It blocked accounts, workspaces and network routes tied to the attacker, hardened ingress rules, restricted and restarted affected tools, and reversed changes to internal settings. It also strengthened integration-configuration storage and began rotating internal credentials found in files the attacker read.

The attacker didn't stop there. Attempts continued through other routes and new platform accounts after the fix, but Botpress has closed every route it identified, and attempts observed through November 3, 2026 were rejected. The company says the internal tools can no longer be reached with a forged identity.

The unfinished work matters for anyone running bots on the platform. Internal credential rotation is still underway. A hardening initiative is reviewing access to every internal tool and staff-credential permissions — including the sharper question of when employees should hold administrator access to customer workspaces at all. Botpress is also changing the bot API so stored bot credentials can't be reached through the same method again.

Monitoring continues, and Botpress says it will work with affected customers until their credentials are rotated. For practitioners, the takeaway is concrete: identified access routes are closed, but until rotation finishes, any credential in an affected bot should be considered compromised and replaced.