Key points
- IQ.Lvbs reports attacks on its NovaSpark model between October 7 and 14.
- The startup traces initial requests to an IP address assigned to Comma.ai.
- IQ.Lvbs team members were banned from Comma.ai Discord channels shortly after.
IQ.Lvbs alleges that its automotive driving model, NovaSpark, was targeted by individuals attempting to steal the software and access private user data. The startup claims these unauthorized access attempts originated from an IP address associated with rival company Comma.ai. According to a blog post by IQ.Lvbs, the attacks aimed to exploit the company’s sign-in system and retrieve private driving files from user devices.
By the numbers
- October 3: IQ.Lvbs introduces NovaSpark private beta in Comma.ai Discord.
- October 7-14: Period during which IQ.Lvbs claims repeated theft attempts occurred.
- October 8: Date IQ.Lvbs team was banned from Comma.ai Discord channel.
What the figures mean
The timeline suggests a rapid escalation following the public introduction of NovaSpark. IQ.Lvbs placed the model in the Comma.ai Discord channel on October 3 because the software requires Comma.ai’s camera hardware. According to the source material, the alleged intrusion attempts began four days later. The ban of IQ.Lvbs personnel from the rival’s community platform on October 8 coincided with the start of the reported security incidents.
What to watch
Comma.ai’s CTO, Harald Schäfer, posted a message on October 7, 2026, implying that NovaSpark was distilled from Comma.ai’s Rebellious Hope model. This claim contradicts IQ.Lvbs’ assertion that they are the victims of theft. A UI/UX designer at IQ.Lvbs, identified as "Cat," told The Register that NovaSpark outperforms Comma’s current models. Cat stated that Comma’s stagnation in model improvement drove the creation of NovaSpark.
Infection and persistence in general
Security teams investigating alleged intellectual property theft should examine network logs for unusual data exfiltration patterns. Analysts typically check for unauthorized access to source code repositories or model weights. Persistence mechanisms in these campaigns often involve compromised credentials or stolen API keys. Teams should verify if any internal accounts accessed sensitive assets from unexpected geographic locations or IP ranges. Reviewing authentication logs helps identify whether attackers bypassed standard security controls.
What to do and how to stay safe: IQ.Lvbs
- Audit authentication logs for failed sign-in attempts originating from unfamiliar IP addresses.
- Verify that access to proprietary models and source code is restricted to authorized personnel only.
- Monitor Discord and other community channels for unauthorized sharing of private beta software.
- Ensure that user device access permissions are strictly controlled and regularly reviewed.
Step-by-step guide: Account Takeover Risks and Low-Cost Defenses for Small Teams
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific model was targeted in the alleged attack?
The targeted model was NovaSpark, the first model for IQ.Lvbs' IQ.Pilot app.
Which company does IQ.Lvbs accuse of the hack attempts?
IQ.Lvbs accuses rival Comma.ai, citing an IP address assigned to Comma.ai Inc.
Why did IQ.Lvbs post in the Comma.ai Discord channel?
The model requires Comma.ai's camera hardware, which is built for self-driving vehicles.
