Auto startup IQ.Lvbs accuses rival Comma.ai of hacking attempts
IQ.Lvbs claims its systems were targeted by actors using a Comma.ai IP address to steal its NovaSpark driving model.
Key points
- IQ.Lvbs reported repeated attempts to steal its NovaSpark model and access user devices between October 7 and 14.
- The startup states the initial requests originated from an IP address assigned to rival Comma.ai.
- IQ.Lvbs team members were banned from the Comma.ai Discord channel shortly after the alleged attacks began.
Automotive technology startup IQ.Lvbs has accused rival Comma.ai of orchestrating cyberattacks aimed at stealing its proprietary driving model. The company stated that attempts to breach its systems originated from an IP address registered to the competitor.
According to a blog post published by IQ.Lvbs, the incidents occurred between October 7 and 14. The startup claims attackers tried to steal the NovaSpark model, access private driving files, and exploit its sign-in system. The first malicious requests came from an IP assigned to Comma.ai Inc.
Context and Background
IQ.Lvbs launched the private beta of NovaSpark on October 3 within the Comma.ai Discord channel. The company used that platform because NovaSpark requires Comma.ai’s camera hardware, which is designed for self-driving vehicles. This integration created a direct technical dependency between the two firms.
Shortly after the alleged attacks began on October 8, IQ.Lvbs team members were banned from the Comma.ai Discord channel. Posts on the IQ.Pilot Discord channel indicate that individuals participating in the private beta for IQ.Lvbs were also removed from the channel.
Who Is Affected
A UI/UX designer for IQ.Lvbs, who requested to be identified only as "Cat," told The Register that NovaSpark outperforms Comma.ai’s current models. Cat suggested this performance gap threatens Comma.ai’s core business of selling hardware supported by adequate AI models.
Cat noted that Comma.ai has been stagnant in model improvements, which motivated the creation of NovaSpark. An October 7, 2026 Discord message from user Torq_boi, identified as Comma.ai CTO Harald Schäfer, implied NovaSpark was distilled from Comma.ai’s Rebellious Hope model.
What should you do?
No patch or fix has been confirmed yet for the alleged vulnerabilities exploited in this incident. Organizations should monitor their network logs for unauthorized access attempts and verify the integrity of their authentication systems. Users should be cautious about sharing proprietary data in public or semi-public channels.
What to do and how to stay safe: IQ.Lvbs
- Monitor server logs for unusual traffic patterns or requests originating from unexpected IP addresses.
- Review access controls for private beta testing groups to ensure only authorized users can access sensitive models.
- Verify the integrity of authentication systems to prevent exploitation of sign-in mechanisms.
- Assume that data shared in competitor-associated channels may be exposed and limit sensitive disclosures.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What evidence does IQ.Lvbs have against Comma.ai?
IQ.Lvbs states that the first attack requests came from an IP address assigned to Comma.ai Inc.
When did the alleged attacks occur?
The incidents took place between October 7 and 14, according to the IQ.Lvbs blog post.
Why was NovaSpark released in the Comma.ai Discord channel?
The model requires Comma.ai’s camera hardware, so the company used that channel for the beta launch.
