Thirty-nine minutes inside sixteen workspaces
Botpress, which sells a platform for building chat and voice agents, disclosed on Friday that an intruder read bot configurations in 16 customer workspaces. The company’s chief technology officer, Michael Masson, gives the window as 07:44 to 08:23 UTC on 21 October — thirty-nine minutes.
The way in was a flaw in how an authentication proxy sitting in front of internal tools validated sign-ins, which let the attacker enter with sessions that looked like they belonged to Botpress staff. Probing of that proxy began on 12 October. From 13 to 21 October the attacker had access to internal tools and connected systems, which exposed customer account information and internal data including information about staff API credentials.
A staff credential with standing admin rights
What turned that access into customer data was an employee’s API credential and the administrator rights attached to it inside customer workspaces. With it the attacker read bot configurations — which include integration settings, and those settings can hold third-party credentials such as AI provider API keys, messaging channel tokens and CRM credentials.
Botpress says it closed the authentication flaw and revoked the credential at about 16:25 UTC the same day. The attacker kept trying other routes and new accounts through 3 November, and the company says every attempt it observed in that period was rejected. Integration settings were also altered in two further workspaces, one integration each, through weaknesses in integration setup flows.
What the logs cannot say
The company’s advice to affected customers is unusually blunt: treat every credential stored in the named bots as exposed and rotate it. The reason is a limit in its own telemetry. The logs show which bots were read on 21 October but cannot show which of those bots held a valid credential at the time.
Botpress says it has no evidence of access to employee identity-provider accounts, to source code, build pipelines or published packages, or to end-user conversations, and that it does not store full payment card numbers.
The motive was compute
The company’s reading of the attacker’s goal is not data theft but resale of AI usage: it says the intruder ran many accounts on the platform to consume AI credits. There has been no ransom demand, and no sign that customer data was published or offered for sale.
The remediation list includes rotating the proxy secret, blocking the attacker’s accounts and network routes, reversing changes to internal settings, and rotating internal credentials that appeared in files the attacker read. Two items point at the design rather than the incident: Botpress plans to change the bot API so stored credentials cannot be reached this way, and it is reviewing whether its own staff should hold administrator access to customer workspaces at all.
That second question is the one worth following across the sector. Agent platforms hold the keys to everything their customers have connected, and a support model that keeps staff standing as administrators turns any one compromised employee credential into every workspace they can reach.
