READ MORE
An automotive tech startup claims that its IT systems were attacked by individuals trying to steal its driving model, and that those attacks came from an IP address associated with a rival in the space.
The tech startup, IQ.Lvbs, described the alleged security incident in a recent blog post.
On October 3, IQ.Lvbs introduced the private beta of NovaSpark, the first model for the company's IQ.Pilot app, in the Comma.ai Discord channel. They put it in that channel because the model requires the use of Comma.ai's camera hardware, which is built for self-driving vehicles.
From there, things got weird.
"From October 7 to 14, we faced repeated attempts to steal NovaSpark, access users’ devices and private driving files, and exploit our sign-in system," the IQ.Lvbs blog post claims. "The first requests came from an IP assigned to Comma.ai Inc."
In addition, on October 8 – shortly after the alleged attacks began – somebody banned IQ.Lvbs' team from the Comma.ai Discord channel. Posts on the IQ.Pilot Discord channel indicate that individuals doing private beta testing for IQ.Lvbs have also been banned from that channel.
One of the three people involved in IQ.Lvbs, a UI/UX designer who asked to be identified only as "Cat," speculated to The Register about the reasons for the alleged hack and Discord ban.
"Our model, NovaSpark, is a good deal ahead of Comma's latest small and large models, which directly threatens their core business of making AI models good enough to sell their hardware," he said. "Comma for the most part has been stagnant in their models' improvement and that was a main driver for us making NovaSpark."
An October 7, 2026 Discord message from user Torq_boi, said to be Harald Schäfer, Comma.ai’s CTO, implies NovaSpark was distilled from Comma.ai's Rebellious Hope model.
“I’m glad people are training models and experimenting with this stuff," the post starts. "But don’t lie to people about what you’re doing, and saying it’s not a finetune of existing comma models when it is. That’s not cool.”
IQ.Lvbs disputes that assertion and says it did the work on its own. "The claim that NovaSpark is Rebellious Hope with a short fine-tune and an unchanged policy does not survive scrutiny, and we’re not sure how Comma came to that conclusion, especially considering that they do not possess NovaSpark’s model weights or ONNX," the biz said.
In the log data IQ.Lvbs published to support its claims, the company flags the username haraschax as one of those associated with Comma.ai IP addresses. Schäfer uses that username on GitHub.
Comma.ai and Schäfer did not respond to requests for comment sent to several different addresses. The Discord user Torq_boi in the Comma.ai channel did not respond to a DM seeking comment.
Comma.ai is currently being investigated [PDF] by the National Highway Traffic Safety Administration to assess whether its driving automation tech contributed to five crashes and three deaths.
IQ.Lvbs says it's considering legal action over the alleged hack. "We are currently reviewing our legal options and looking into involving the authorities," said Cat. ®
