Comet discloses Opik security incident on comet.com
Comet ML disclosed that it contained a security incident affecting Opik on comet.com, with containment reported on October 26, 2026. According to the company, an unauthorized actor operated between October 24 and 26 using a comet.com user API key to access internal test workspaces and abused Opik AI provider settings to extract twenty-nine internal OpenAI and Anthropic API keys. Comet states that no customer data, customer accounts, or customer API keys were accessed. The disclosure highlights how observability and MLOps platforms can become a pivot point when provider credentials are stored in product configuration, even when end-user tenants were not directly breached. Readers should treat vendor containment claims as provisional until independent verification or fuller technical detail appears in the post.
Comet discloses Opik security incident on comet.com
Comet says it contained a security incident affecting Opik on comet.com on October 26, 2026. An unauthorized party used a comet.com user API key to reach internal test workspaces and exploited Opik AI provider settings to obtain 29 internal OpenAI and Anthropic API keys; Comet reports no customer data, accounts, or customer API keys were accessed.
Key takeaway
A stolen comet.com user API key plus Opik provider settings exposed 29 internal LLM vendor keys in test workspaces, not customer tenants.
What happened
Comet says it contained a security incident affecting Opik on comet.com on October 26, 2026, and published an incident post describing what happened, what was affected, and its response.
Between October 24 and 26, 2026, an unauthorized party used a comet.com user API key to reach internal test workspaces and exploited Opik AI provider settings to obtain 29 internal OpenAI and Anthropic API keys; Comet reports no customer data, accounts, or customer API keys were accessed.
Evidence
Comet contained the Opik incident on comet.com on October 26, 2026.
Comet ML · attributed
On October 26, 2026, Comet contained a security incident affecting Opik on comet.com.
The attacker used a comet.com user API key between October 24 and 26, 2026.
Comet ML · attributed
Between October 24 and 26, 2026, an unauthorized party used a comet.com user API key
Opik AI provider settings were exploited to obtain 29 internal OpenAI and Anthropic API keys.
Comet ML · attributed
exploited Opik AI provider settings to obtain 29 internal OpenAI and Anthropic API keys
Comet reports no customer data, accounts, or customer API keys were accessed.
Comet ML · attributed
No customer data, accounts, or API keys were accessed.
Why it matters
Internal test workspaces and centralized AI provider configuration in Opik can amplify credential theft beyond a single user key when controls fail.
Limits and uncertainties
Available excerpts in the packet are truncated mid-sentence, so full scope, root cause, and remediation steps beyond containment are not fully visible here.
Practical implications
Rotate and scope comet.com user API keys aggressively, segregate test workspaces from production, and audit Opik AI provider settings for stored third-party API keys.
What to watch
Whether Comet publishes complete timeline, revocation status for the 29 internal OpenAI and Anthropic keys, and any third-party provider notifications.
