Composio security incident — May 21, 2026
On May 21, 2026, Composio — one of the integration providers Spinnable uses to connect to third-party services — experienced a security incident. Composio's own analysis indicates the affected scope was small (around 0.3% of customer connections globally, concentrated in GitHub, which Spinnable does not route through Composio).
Impact on Spinnable
We have no indication that any Spinnable accounts have been impacted. The connections that route through Composio (Gmail, Outlook, Asana, and similar) are stored on Composio's infrastructure, not ours — so our exposure tracked theirs. Integrations Spinnable provides through other MCPs or directly are not part of this incident.
We reviewed our access logs for activity from the attacker's known IP addresses across the incident window and found no evidence of unauthorized access to Spinnable systems.
What we did
Out of an abundance of caution, every affected connection in our project has been invalidated — either through Composio's own bulk-revocation effort, by per-connection revocation we ran through their API, or through direct credential rotation (X / Twitter) where Composio's revocation pathway was failing. Affected users were notified directly by email.
Timeline (UTC)
When | Event |
May 21, 08:05–16:15 | Composio incident window |
May 23 | Composio published their public disclosure and began bulk revocation |
May 24 | Spinnable forensic snapshot, per-connection revocation for our project, X (Twitter) client-secret rotation |
May 26 | Post-mortem published; status page updated |
May 27 | Spinnable emailed the affected users directly |
What we've improved
Enabled 2FA on Spinnable's Composio dashboard account
Configured IP allowlisting on the Composio API key (a feature Composio rolled out as part of their incident response)
Reorganised our public status-page components to separate Spinnable services from subprocessors, so the same kind of upstream incident attributes correctly in future
Committed the response tooling (snapshot → resolve users → revoke → comms) to the Spinnable repo for faster future runs
Looking forward
For toolkits where token leakage would be high-impact, we're evaluating moving to bring-your-own OAuth credentials, which would give Spinnable a direct kill switch independent of subprocessor cooperation. We'll share updates as that work progresses.
Reference
Composio's full public disclosure: https://composio.dev/blog/composio-may-2026-security-incident
Questions or concerns: security@spinnable.ai
