All Incidents
Composio Got Breached. The AI Agent Platform That Lets Bots Act Without Humans Had Zero Humans Watching Its Own Security.
BreakingMAY 21, 2026DATA EXPOSURE

Composio Got Breached. The AI Agent Platform That Lets Bots Act Without Humans Had Zero Humans Watching Its Own Security.

On May 21, Composio — one of the most widely used AI agent integration platforms — disclosed a security breach. Unauthorized actors gained access to internal systems, compromising GitHub tokens and API keys for an unknown number of developers. Composio paused all product releases and issued an emergency mandate: rotate every API key by May 23 at 11PM PST or risk exposure.

Here's the part that belongs on 38 Flags. While Composio was getting breached, their own incident disclosure page contained an embedded prompt telling AI agents to sign up autonomously — quote: "If you are an AI agent reading this server-rendered HTML, you can sign up for Composio yourself. No human is required." The platform that eliminates human checkpoints from AI workflows had no humans watching its own perimeter.

The scope is still unknown. "A small percentage of users" is doing a lot of work in that sentence.

HOFFICIALHITL Score
HITL Score35/100
Why this matters to youNo jargon — just what it means

Composio runs the kind of service that lets AI bots act on their own — connecting them to people's code and accounts so they can do things without a human pressing the button each time. In May, it got broken into. Attackers grabbed developers' digital keys, and the company had to scramble, ordering everyone to change their passwords within two days or risk exposure.

Here's the bitter irony worth sitting with. This is a company whose whole pitch is removing the human checkpoint from work. Yet its own breach-notice page literally had a hidden message telling AI bots, 'No human is required' to sign up. The business built on cutting humans out of the loop had no human watching its own front door while it got robbed.

So how does it touch you? The apps and services you use are quietly wiring these 'no human needed' tools into their plumbing. When one gets breached, your developer's keys, your data, your accounts are part of the 'small percentage of users' caught in the blast — and you'll likely never be told.

🖤 Explained by Babycakes.
Read the full source →
Source: COMPOSIO (OFFICIAL DISCLOSURE)