{"id":20840,"date":"2026-10-27T22:50:42","date_gmt":"2026-10-27T22:50:42","guid":{"rendered":"https:\/\/www.comet.com\/site\/?p=20840"},"modified":"2026-10-27T22:50:42","modified_gmt":"2026-10-27T22:50:42","slug":"security-incident-october-2026","status":"publish","type":"post","link":"https:\/\/www.comet.com\/site\/blog\/security-incident-october-2026\/","title":{"rendered":"Opik Security Incident: October 2026"},"content":{"rendered":"\n

No customer data, accounts, or API keys were accessed.<\/strong> On October 26, 2026, Comet contained a security incident affecting Opik on comet.com. This post explains what happened, what was affected, and what we have done in response.<\/p>\n\n\n\n

What happened<\/h2>\n\n\n\n

Between October 24 and 26, 2026, an unauthorized party used a comet.com user API key from an inactive account to access a small number of Comet’s own internal test workspaces on comet.com. This is the same kind of key any Opik user has; it does not grant access to Comet’s internal systems. We have no evidence that Comet’s systems were involved in how the key was obtained. The account had no admin rights and no access to customer workspaces or data.<\/p>\n\n\n\n

From those test workspaces, the attacker exploited a flaw in Opik’s AI provider settings to obtain 29 API keys that Comet uses internally for OpenAI and Anthropic. The attacker also tried to use the same flaw to reach other Comet systems and did not obtain any customer data.<\/p>\n\n\n\n

What was affected<\/h2>\n\n\n\n
Area<\/th>Affected<\/th>Details<\/th><\/tr>
Customer data in Opik (traces, spans, datasets, prompts)<\/td>No<\/td>Not accessed.<\/td><\/tr>
Customer and user accounts<\/td>No<\/td>No customer or user account was accessed or taken over.<\/td><\/tr>
Customer AI provider keys<\/td>No<\/td>Only keys stored in Comet’s own Opik test workspaces were exposed.<\/td><\/tr>
Comet’s own AI provider keys (stored in Opik test workspaces)<\/td>Yes<\/td>29 keys for third-party AI providers were obtained and have been revoked.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Steps taken by the Comet team<\/h2>\n\n\n\n

As soon as an AI provider alerted us to unusual activity on October 26, we contained the incident and blocked the exploited functionality the same morning, then deployed a fix. We revoked all 29 exposed keys, removed the inactive account from every workspace, audited all workspaces for stale members, and rotated all internal credentials as a precaution.<\/p>\n\n\n\n

We then reviewed the access logs for the affected workspaces and for every account the attacker created, and verified that no customer data was exposed.<\/p>\n\n\n\n

While we deployed the fix, Opik on comet.com was unavailable for about two hours on October 26. Some features, including AI provider settings, the Playground, and Ollie, were temporarily disabled.<\/p>\n\n\n\n

We have also made the following changes:<\/p>\n\n\n\n

    \n
  • Opik now requires the API key to be re-entered when a provider address changes, and restricts which addresses provider requests can reach.<\/li>\n\n\n\n
  • Added additional monitoring for provider settings changes and unusual outbound traffic.<\/li>\n<\/ul>\n\n\n\n

    What you should do now<\/h2>\n\n\n\n

    If you use Opik on comet.com, or a dedicated deployment managed by Comet, there is nothing you need to do. The fix is already in place.<\/p>\n\n\n\n

    If your team runs self-hosted or open-source Opik, your deployment was not affected by this incident, which was limited to comet.com. The underlying flaw did exist in previous open-source releases, but using it requires an account in your deployment with permission to edit AI provider settings, and self-hosted Opik does not allow public sign-ups by default. Only people you have invited could do this. That said we recommend upgrading to the latest version.<\/p>\n\n\n\n

    Questions<\/h2>\n\n\n\n

    If you have questions about this incident or how it relates to your account, contact your Comet account team or Comet support. We will update this post if anything changes.<\/p>\n","protected":false},"excerpt":{"rendered":"

    No customer data, accounts, or API keys were accessed. On October 26, 2026, Comet contained a security incident affecting Opik on comet.com. This post explains what happened, what was affected, and what we have done in response. What happened Between October 24 and 26, 2026, an unauthorized party used a comet.com user API key from […]<\/p>\n","protected":false},"author":139,"featured_media":19318,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"customer_name":"","customer_description":"","customer_industry":"","customer_technologies":"","customer_logo":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[10],"tags":[],"coauthors":[352],"class_list":["post-20840","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-industry"],"yoast_head":"\nOpik Security Incident: October 2026 - Comet<\/title>\n<meta name=\"description\" content=\"No customer data, accounts, or API keys were accessed. On October 26, 2026, Comet contained a security incident affecting Opik on comet.com. This post explains what happened, what was affected, and what we have done in response.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.comet.com\/site\/blog\/security-incident-october-2026\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Opik Security Incident: October 2026\" \/>\n<meta property=\"og:description\" content=\"No customer data, accounts, or API keys were accessed. On October 26, 2026, Comet contained a security incident affecting Opik on comet.com. This post explains what happened, what was affected, and what we have done in response.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.comet.com\/site\/blog\/security-incident-october-2026\/\" \/>\n<meta property=\"og:site_name\" content=\"Comet\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cometdotml\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-27T22:50:42+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.comet.com\/site\/wp-content\/uploads\/2026\/03\/comet-logo-larger.png\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1440\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Nimrod Lahav\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Cometml\" \/>\n<meta name=\"twitter:site\" content=\"@Cometml\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Nimrod Lahav\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Opik Security Incident: October 2026 - Comet","description":"No customer data, accounts, or API keys were accessed. On October 26, 2026, Comet contained a security incident affecting Opik on comet.com. This post explains what happened, what was affected, and what we have done in response.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.comet.com\/site\/blog\/security-incident-october-2026\/","og_locale":"en_US","og_type":"article","og_title":"Opik Security Incident: October 2026","og_description":"No customer data, accounts, or API keys were accessed. On October 26, 2026, Comet contained a security incident affecting Opik on comet.com. This post explains what happened, what was affected, and what we have done in response.","og_url":"https:\/\/www.comet.com\/site\/blog\/security-incident-october-2026\/","og_site_name":"Comet","article_publisher":"https:\/\/www.facebook.com\/cometdotml","article_published_time":"2026-10-27T22:50:42+00:00","og_image":[{"width":2560,"height":1440,"url":"https:\/\/www.comet.com\/site\/wp-content\/uploads\/2026\/03\/comet-logo-larger.png","type":"image\/png"}],"author":"Nimrod Lahav","twitter_card":"summary_large_image","twitter_creator":"@Cometml","twitter_site":"@Cometml","twitter_misc":{"Written by":"Nimrod Lahav","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.comet.com\/site\/blog\/security-incident-october-2026\/#article","isPartOf":{"@id":"https:\/\/www.comet.com\/site\/blog\/security-incident-october-2026\/"},"author":{"name":"Nimrod Lahav","@id":"https:\/\/www.comet.com\/site\/#\/schema\/person\/4a54423cd21e28c248c2a6a5d9ca2017"},"headline":"Opik Security Incident: October 2026","datePublished":"2026-10-27T22:50:42+00:00","mainEntityOfPage":{"@id":"https:\/\/www.comet.com\/site\/blog\/security-incident-october-2026\/"},"wordCount":538,"commentCount":0,"publisher":{"@id":"https:\/\/www.comet.com\/site\/#organization"},"image":{"@id":"https:\/\/www.comet.com\/site\/blog\/security-incident-october-2026\/#primaryimage"},"thumbnailUrl":"https:\/\/www.comet.com\/site\/wp-content\/uploads\/2026\/03\/comet-logo-larger.png","articleSection":["Industry"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.comet.com\/site\/blog\/security-incident-october-2026\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.comet.com\/site\/blog\/security-incident-october-2026\/","url":"https:\/\/www.comet.com\/site\/blog\/security-incident-october-2026\/","name":"Opik Security Incident: October 2026 - Comet","isPartOf":{"@id":"https:\/\/www.comet.com\/site\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.comet.com\/site\/blog\/security-incident-october-2026\/#primaryimage"},"image":{"@id":"https:\/\/www.comet.com\/site\/blog\/security-incident-october-2026\/#primaryimage"},"thumbnailUrl":"https:\/\/www.comet.com\/site\/wp-content\/uploads\/2026\/03\/comet-logo-larger.png","datePublished":"2026-10-27T22:50:42+00:00","description":"No customer data, accounts, or API keys were accessed. On October 26, 2026, Comet contained a security incident affecting Opik on comet.com. This post explains what happened, what was affected, and what we have done in response.","breadcrumb":{"@id":"https:\/\/www.comet.com\/site\/blog\/security-incident-october-2026\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.comet.com\/site\/blog\/security-incident-october-2026\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.comet.com\/site\/blog\/security-incident-october-2026\/#primaryimage","url":"https:\/\/www.comet.com\/site\/wp-content\/uploads\/2026\/03\/comet-logo-larger.png","contentUrl":"https:\/\/www.comet.com\/site\/wp-content\/uploads\/2026\/03\/comet-logo-larger.png","width":2560,"height":1440},{"@type":"BreadcrumbList","@id":"https:\/\/www.comet.com\/site\/blog\/security-incident-october-2026\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.comet.com\/site\/"},{"@type":"ListItem","position":2,"name":"Opik Security Incident: October 2026"}]},{"@type":"WebSite","@id":"https:\/\/www.comet.com\/site\/#website","url":"https:\/\/www.comet.com\/site\/","name":"Comet","description":"Build Better Models Faster","publisher":{"@id":"https:\/\/www.comet.com\/site\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.comet.com\/site\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.comet.com\/site\/#organization","name":"Comet ML, Inc.","alternateName":"Comet","url":"https:\/\/www.comet.com\/site\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.comet.com\/site\/#\/schema\/logo\/image\/","url":"https:\/\/www.comet.com\/site\/wp-content\/uploads\/2025\/01\/logo_comet_square.png","contentUrl":"https:\/\/www.comet.com\/site\/wp-content\/uploads\/2025\/01\/logo_comet_square.png","width":310,"height":310,"caption":"Comet ML, Inc."},"image":{"@id":"https:\/\/www.comet.com\/site\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/cometdotml","https:\/\/x.com\/Cometml","https:\/\/www.youtube.com\/channel\/UCmN63HKvfXSCS-UwVwmK8Hw"]},{"@type":"Person","@id":"https:\/\/www.comet.com\/site\/#\/schema\/person\/4a54423cd21e28c248c2a6a5d9ca2017","name":"Nimrod Lahav","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.comet.com\/site\/#\/schema\/person\/image\/32c89ff6d2f054014472f77885cf369b","url":"https:\/\/www.comet.com\/site\/wp-content\/uploads\/2026\/03\/nimrod-lahav-96x96.jpeg","contentUrl":"https:\/\/www.comet.com\/site\/wp-content\/uploads\/2026\/03\/nimrod-lahav-96x96.jpeg","caption":"Nimrod Lahav"},"description":"A computer scientist and software engineer, Nimrod is Comet's co-founder and CTO. He held leadership and engineering roles at Wix, VMware and Amdocs. He later co-founded GroupWize, whose team trained and deployed more than 50 natural language processing (NLP) models in 15 languages to analyze chat messages. He holds a bachelor\u2019s degree from the Academic College of Tel Aviv, Yaffo (MTA).","url":"https:\/\/www.comet.com\/site\/blog\/author\/nimrod\/"}]}},"jetpack_featured_media_url":"https:\/\/www.comet.com\/site\/wp-content\/uploads\/2026\/03\/comet-logo-larger.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.comet.com\/site\/wp-json\/wp\/v2\/posts\/20840","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.comet.com\/site\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.comet.com\/site\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.comet.com\/site\/wp-json\/wp\/v2\/users\/139"}],"replies":[{"embeddable":true,"href":"https:\/\/www.comet.com\/site\/wp-json\/wp\/v2\/comments?post=20840"}],"version-history":[{"count":1,"href":"https:\/\/www.comet.com\/site\/wp-json\/wp\/v2\/posts\/20840\/revisions"}],"predecessor-version":[{"id":20880,"href":"https:\/\/www.comet.com\/site\/wp-json\/wp\/v2\/posts\/20840\/revisions\/20880"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.comet.com\/site\/wp-json\/wp\/v2\/media\/19318"}],"wp:attachment":[{"href":"https:\/\/www.comet.com\/site\/wp-json\/wp\/v2\/media?parent=20840"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.comet.com\/site\/wp-json\/wp\/v2\/categories?post=20840"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.comet.com\/site\/wp-json\/wp\/v2\/tags?post=20840"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.comet.com\/site\/wp-json\/wp\/v2\/coauthors?post=20840"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}