IQ.Lvbs Claims Rival Comma.ai IP Targeted NovaSpark Model
Startup alleges repeated attempts to steal driving AI model and access user devices originated from competitor's infrastructure.
Key points
- IQ.Lvbs detected unauthorized access attempts targeting its NovaSpark model and sign-in system between October 7 and 14.
- The startup states the initial requests originated from an IP address assigned to rival Comma.ai Inc.
- IQ.Lvbs team members and beta testers were subsequently banned from the Comma.ai Discord channel.
The attacker sought to steal the NovaSpark model and access private user files by targeting the startup's sign-in system. According to IQ.Lvbs, these attempts originated from an IP address associated with a direct competitor. The startup claims the model is ahead of rival offerings, which it says threatens the competitor's core business.
How it unfolded
- On October 3, IQ.Lvbs announced the private beta of NovaSpark within the Comma.ai Discord channel due to hardware dependencies.
- From October 7 to 14, the startup faced repeated attempts to steal the model and exploit authentication systems, starting from a Comma.ai IP.
- On October 8, IQ.Lvbs staff and beta testers were banned from the Comma.ai Discord channel shortly after the alleged attacks began.
Who is affected
IQ.Lvbs reported that its IT systems were targeted, specifically the sign-in infrastructure and storage for private driving files. The startup claims individuals attempted to access user devices linked to the IQ.Pilot app. Beta testers for the NovaSpark model were also impacted, as they were banned from the Comma.ai community platform during the incident.
The fix
No patch or remediation update has been confirmed by IQ.Lvbs for the alleged sign-in system exploitation. The startup has described the incident in a blog post but has not provided technical details on how the vulnerabilities were addressed. Users should monitor official channels for further updates regarding system security improvements.
What made it possible
This incident highlights risks associated with exposing proprietary assets in shared community platforms. Teams usually restrict beta access to isolated environments to prevent cross-account contamination. Check whether authentication mechanisms adequately separate vendor infrastructure from third-party networks. Verify that API endpoints require strict origin validation to prevent unauthorized model extraction or data scraping from competitor sources.
What to do and how to stay safe: IQ.Lvbs
- Review server logs for repeated failed login attempts or unusual traffic patterns from known competitor IP ranges.
- Audit access controls on private beta channels and ensure only verified testers can view sensitive model data.
- Monitor Discord and other community platforms for sudden bans or exclusion of staff members, which may signal coordinated action.
- Isolate proprietary AI models from public-facing APIs until robust authentication and rate-limiting measures are verified.
Step-by-step guide: DDoS Attack Mechanics: Answers to 10 Critical Questions
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What model was targeted in this alleged attack?
The NovaSpark model, the first model for IQ.Lvbs' IQ.Pilot app, was the target of the alleged theft attempts.
When did the unauthorized access attempts occur?
IQ.Lvbs states the attempts occurred from October 7 to October 14.
Did Comma.ai confirm involvement in the attacks?
No, Comma.ai has not confirmed involvement; the allegations are based on IP address tracing by IQ.Lvbs.
