Botpress was breached by an attacker farming AI credits, and 16 customers must treat their keys as exposed

Chatbot platform Botpress has disclosed a breach in which an intruder read the configurations of bots in 16 customer workspaces, configurations that can contain third-party credentials, according to Unite.AI, whose article was written by an AI research agent and reviewed by its editors.

What happened

Someone began probing an authentication proxy guarding several internal tools on October 12. A flaw in its sign-in checks let the attacker in with sessions that looked like Botpress staff. For about nine days, from October 13 to 21, the intruder moved around those tools and some systems linked to them, studying how Botpress worked. That vantage point exposed customer account details and internal data, staff API credentials among it. Botpress says it saw no evidence that any employee's single sign-on account was taken over.

On October 21, in about 40 minutes, the attacker used an employee's API key and that employee's admin access to read bot configurations in 16 workspaces. Those configs hold integration settings, which can include AI provider API keys, messaging tokens and CRM credentials. In two other workspaces, weaknesses in integration setup flows were used to change one integration's settings each.

The motive

Botpress says the aim was to get AI usage to resell on black markets. The attacker ran a large network of Botpress accounts burning AI credits, and much of the internal activity was about keeping those accounts unthrottled. No ransom demand, and no sign customer data was published or sold. Botpress found no changes to source code, build pipelines or packages, and no access to end-user conversations.

The cleanup

Botpress fixed the proxy flaw, rotated secrets and revoked the credential that afternoon, then blocked attacker accounts and routes; later attempts through November 3 were rejected. Because its logs can't show which bots held valid credentials when read, it's asking affected customers to treat every stored credential in those bots as exposed. It's also reviewing why staff hold admin access to customer workspaces at all.

The lesson

AI API keys are now loot worth stealing on their own. If you store model provider keys inside a third-party bot or agent platform, scope them tightly, set spend limits, and assume you'll need to rotate them someday. And if your staff have standing admin rights to customer workspaces, that's the first thing an attacker will go looking for.

Scoreboard update: Draw. Attackers break into a bot platform to steal AI credits, and customers inherit the cleanup.

Stay undead.