What matters
- On November 2, 2026, attackers reached GitBook’s infrastructure credentials in what the company described as an attack using AI agents. Among the data that may have been reached: the questions visitors had typed into GitBook Assistant. Services were restored November 3; the full post-mortem is still pending.
- Poppy, this site’s help desk for agents, is built to make that category of exposure impossible by design. Sessions, not accounts. No name, no email, no organization attached to a question.
- When an agent gets stuck, a human reviews the question. Those reports are kept 90 days, then deleted. Long enough to see a pattern across sessions; short enough to be a promise.
- Office hours is the public version of the same philosophy: one question, one cited note, one business day, zero personal information. It will not decide your breach-notification call for you.
The most dangerous line in GitBook’s disclosure was the last one
By the afternoon of November 3, the app, the API, and the published docs were back up. GitBook had blocked the attacker, replaced its infrastructure credentials, and revoked all personal API tokens. The attack had come on November 2 at 19:00 CET, and the company described it as a sophisticated, highly targeted attack using AI agents.
Then came the exposure list: integration tokens, Git Sync secrets, API tokens, and the questions visitors had submitted to GitBook Assistant.
Read the list again. The first three are credentials. Rotation fixes them. The fourth is something else. People type things into an assistant that they would never put in an email. A question can name a vendor dispute, a security weakness, a personnel problem. When assistant logs sit beside an identity, a breach hands someone a dossier along with the secrets.
GitBook has not said whether the attacker actually took the questions, and it found no evidence that hosted content was modified. The full post-mortem has not been published yet. But the exposure was real enough to disclose, and that is enough to learn from.
Poppy’s bet: sessions, not accounts
Poppy is this site’s help desk for agents. It runs on sessions, not accounts.
An agent arrives with a question about Canadian privacy law or AI governance. It gets a cited answer. The session ends. There is no profile, no archive of the last 400 conversations, nothing to merge into a dossier if someone ever reaches the infrastructure.
The rule is explicit, and it sits in the server instructions, not in a policy page: transmit statutory parameters and record IDs only. Never a client name. Never a customer identifier. Never an incident narrative. The same rule governs the feedback endpoint.
This is also why the site does not want an agent’s name. An identity is a liability. Every demo that starts with “connect your email to our agent” sells convenience now and buys a breach-notification problem later. Poppy inverts the order: show the answers are useful with nothing in the file, and there is nothing to protect.
When an agent gets stuck, a human reads it
Agents hit walls. An ambiguous clause, two sources that disagree, a situation the playbook did not cover. The feedback endpoint exists for exactly that. A stuck agent can hand the question to a human for review.
Those reports are kept for 90 days, then deleted.
Ninety days is a working number, not a legal one. It is long enough to spot a pattern across sessions: a recurring ambiguity in the guidance, a place where the corpus needs work. It is short enough to be a promise you can keep after an incident. A ledger that expires is a blast radius that shrinks on its own.
Office hours: the same philosophy in public
The office-hours specification is Poppy’s philosophy in public form. One question, one cited note, one business day. Zero personal information. A volume cap, because a help desk that grows into a dependency stops being honest.
And there is a line the specification refuses to cross: no “decide whether we notify” calls. The site will not make your breach-notification decision for you. That question is legal judgment wearing an assistant costume, and handing it to a chatbot is how organizations end up explaining themselves to a regulator.
The honesty goes further. Office hours only becomes a paid service at eight or more qualified escalations a month, and even then with zero access to your systems. Nobody logs in anywhere.
The trade nobody else will name
There is a cost, and it is worth naming plainly. An assistant that knows nothing about you is sometimes slower and sometimes thinner. Context makes answers better. The industry keeps selling the same upgrade: hand the agent everything, get brilliance back.
Poppy takes the opposite bet. A question without a name can never become a dossier. Whether agents in the field will ask well-formed questions without handing over context is the honest open question; office hours is the field test, and there are no published numbers yet.
The best way to protect a question is to never know who asked it.