// Dev
Botpress was breached by an attacker farming AI credits, and 16 customers must treat their keys as exposed
A flaw in an internal sign-in proxy and a staff API key let the intruder read bot configs that can hold AI provider keys and CRM tokens. The goal, Botpress says, was reselling AI usage.