Botpress: Intruder Accessed Bot Configurations and Stored API Keys Across 16 Customer Workspaces
Conversational agent platform Botpress revealed that an attacker exploited a vulnerability in its internal authentication proxy in October to read bot configurations across 16 customer workspaces. AI provider API keys, messaging tokens, and CRM credentials stored within them should be considered compromised.
A conversational agent is only as powerful as the services plugged into it, and every connection leaves a key stored in its configuration. That very keychain was accessed by an intruder at Botpress, a platform for building bots and agents. In an incident disclosure published on November 6, CTO Michael Masson explained that an attacker read the bot configurations of 16 customer workspaces in October.
An Internal Proxy, Then an Employee Account
It all started with a vulnerability in the authentication proxy shielding several internal tools. Beginning on October 12, the attacker probed the proxy and eventually gained access using sessions that appeared to belong to employees, though without compromising their accounts at the identity provider, according to Botpress. Between October 13 and 21, the intruder navigated internal tools and connected systems, viewing customer account details as well as data tied to staff API credentials.
On October 21, between 7:44 AM and 8:23 AM UTC, the attacker leveraged the API credential of an employee who held admin privileges in multiple customer workspaces by virtue of membership, using it to read their bot configurations. These settings include integration configurations: AI provider API keys, messaging channel tokens, and CRM credentials. In two additional workspaces, the attacker altered settings for an integration. The vulnerability was patched that same day around 4:25 PM UTC, and further intrusion attempts observed through November 3 failed.
The Motive: Reselling AI Compute
Botpress described a straightforward objective: securing AI usage to resell on illicit markets. Prior to and during the breach, the attacker operated a sprawling network of accounts on the platform to burn through AI credits. The company stated it received no ransom demands and found no customer data leaked or listed for sale.
Next Steps for Customers
Owners of the affected workspaces were contacted and provided with a list of the implicated bots and integrations. Because Botpress cannot verify from logs which configurations held active keys at the moment of access, it urged teams to treat every stored credential as exposed and rotate it directly with the issuing service. Customers who were not contacted show no signs of unauthorized access, according to the vendor. Botpress is overhauling employee permissions—including ending staff admin access within customer workspaces—and updating its API so bot credentials can no longer be retrieved this way.
Our take
This incident highlights a vulnerability inherent to agent platforms: they centralize keys for every service their customers integrate, and an AI provider key can be turned into immediate cash through resold tokens. Here, the weak link was not a customer, but an internal tool and an employee endowed with overly broad permissions. For teams running workloads on such platforms, the takeaway is straightforward: use dedicated keys for each bot, enforce strict spending caps, and ensure they can be revoked instantly to contain the blast radius if the host’s vault is ever cracked. Botpress’s postmortem is detailed and clearly dated, yet it remains the sole source on how the breach unfolded.
Sources
- Botpress — Security incident disclosure, November 2026 (November 6, 2026) Primary source
- Unite.AI — Botpress Discloses Internal Breach and Customer Credential Risk Secondary source
A primary source comes directly from the company, lab or organization concerned. A secondary source reports the information without being its author: we flag it as such. Spotted an error? See our corrections policy.
