self.md radar — 2026-11-04
GitBook is back; its tokens are revoked
GitBook users need to replace revoked API tokens and rotate connected secrets
the company says its app and API are available again, though some services may remain degraded
1. GitBook revokes API tokens; MCP users must re-authenticate
GitBook’s November 3 incident update lists integration tokens, Git Sync secrets, API tokens and visitors’ GitBook Assistant questions among the data an attacker may have accessed
the company dates the infrastructure-credential breach to 19:00 CET on November 2
the instructions changed within the same afternoon
at 13:15 CET on November 3, GitBook said customers needed to do nothing yet
by 16:21, it was asking them to rotate API tokens, third-party credentials and published-integration secrets, and to re-authenticate the GitBook MCP server
GitBook says it replaced its infrastructure secrets and invalidated customer API tokens
it reports no evidence that documentation content was modified, while warning that some services may remain degraded
reading: GitBook’s exposure list and recovery instructions
2. Tracker CE saves patterns older firmware cannot read
Polyend’s Tracker CE 1.0.0 changelog says old projects load and upgrade in memory, but saving writes Version 6 pattern files that older firmware cannot read
keep a backup of the SD card’s Projects/ folder, or use Save As before experimenting
the November 2 release supplies firmware for the Original Tracker, Tracker+ and Tracker Mini
all three can load sample-editor effects from /Effects/*.ptfx on the SD card
the recovery procedure can re-flash a stable firmware image through the hardware bootloader; it does not reverse the pattern-file migration
the license also changed after the release tag
version 1.0.0 carries PolyForm Noncommercial terms with extra permissions
the November 3 revision expressly permits commercial reuse of individual components under MIT terms, while retaining a restriction on wholesale commercial clones
selling firmware builds remains prohibited, and the precompiled synth and DSP libraries remain proprietary
reading: device-specific firmware downloads · flashing and emergency recovery
3. a better fit loses on unsatz’s unseen experiment
in Figure 3 of the unsatz paper, a DeepSeek agent revises its model of an ecological system
the final version cuts training error to a quarter of the earlier model’s error across eight purchased runs
on a held-out run from a different starting state, it diverges
unsatz asks agents to choose the variables, hidden states and equations of a simulated system
experiments cost budget units; a shared fitting service estimates each proposed program’s coefficients
the last submitted program is tested on unseen conditions, interventions and longer runs; deterministic worlds use the worst test group’s error
the authors evaluate nine models on 80 systems across 20 domains and report solve rates from 21% to 60%
these are generated worlds in a defined modeling language, not an unrestricted test of laboratory discovery
reading: unsatz’s methods, results and failed revision
left on the table
GitBook attributes the attack to AI agents, but the checked update does not reconstruct their role
a detailed post-mortem is still promised