Opik Security Incident: October 2026

Comet reported that an unauthorized party used an API key from an inactive, non-administrative comet.com account between October 24 and 26, 2026, to access a small number of internal Opik test workspaces and exploit a flaw in AI provider settings, obtaining 29 internally used OpenAI and Anthropic API keys. Comet stated that no customer data, customer accounts, customer AI provider keys, or internal systems were accessed, and that the exposed third-party keys were revoked. After an AI provider identified unusual activity on October 26, Comet blocked the vulnerable functionality, deployed a fix, removed the inactive account, audited workspace membership and logs, rotated internal credentials, and experienced roughly two hours of Opik downtime while some features were temporarily disabled. The company also added provider-address verification and restrictions, along with enhanced monitoring, and said cloud users need take no action, while self-hosted users were not affected but are advised to upgrade because the underlying flaw existed in earlier open-source versions.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.