No customer data, accounts, or API keys were accessed. On October 26, 2026, Comet contained a security incident affecting Opik on comet.com. This post explains what happened, what was affected, and what we have done in response.
What happened
Between October 24 and 26, 2026, an unauthorized party used a comet.com user API key from an inactive account to access a small number of Comet’s own internal test workspaces on comet.com. This is the same kind of key any Opik user has; it does not grant access to Comet’s internal systems. We have no evidence that Comet’s systems were involved in how the key was obtained. The account had no admin rights and no access to customer workspaces or data.
From those test workspaces, the attacker exploited a flaw in Opik’s AI provider settings to obtain 29 API keys that Comet uses internally for OpenAI and Anthropic. The attacker also tried to use the same flaw to reach other Comet systems and did not obtain any customer data.
What was affected
| Area | Affected | Details |
|---|---|---|
| Customer data in Opik (traces, spans, datasets, prompts) | No | Not accessed. |
| Customer and user accounts | No | No customer or user account was accessed or taken over. |
| Customer AI provider keys | No | Only keys stored in Comet’s own Opik test workspaces were exposed. |
| Comet’s own AI provider keys (stored in Opik test workspaces) | Yes | 29 keys for third-party AI providers were obtained and have been revoked. |
Steps taken by the Comet team
As soon as an AI provider alerted us to unusual activity on October 26, we contained the incident and blocked the exploited functionality the same morning, then deployed a fix. We revoked all 29 exposed keys, removed the inactive account from every workspace, audited all workspaces for stale members, and rotated all internal credentials as a precaution.
We then reviewed the access logs for the affected workspaces and for every account the attacker created, and verified that no customer data was exposed.
While we deployed the fix, Opik on comet.com was unavailable for about two hours on October 26. Some features, including AI provider settings, the Playground, and Ollie, were temporarily disabled.
We have also made the following changes:
- Opik now requires the API key to be re-entered when a provider address changes, and restricts which addresses provider requests can reach.
- Added additional monitoring for provider settings changes and unusual outbound traffic.
What you should do now
If you use Opik on comet.com, or a dedicated deployment managed by Comet, there is nothing you need to do. The fix is already in place.
If your team runs self-hosted or open-source Opik, your deployment was not affected by this incident, which was limited to comet.com. The underlying flaw did exist in previous open-source releases, but using it requires an account in your deployment with permission to edit AI provider settings, and self-hosted Opik does not allow public sign-ups by default. Only people you have invited could do this. That said we recommend upgrading to the latest version.
Questions
If you have questions about this incident or how it relates to your account, contact your Comet account team or Comet support. We will update this post if anything changes.
