Fireworks AI, a San Mateo company that hosts AI models for developers, has confirmed two separate intrusions in October 2026. Attackers stole customer account and billing records, along with API keys, datasets and partial model weights for some accounts. The company published an updated security bulletin on Monday, November 9. Palo Alto Networks Unit 42 is leading the forensic investigation. The company links the attacks to a financially motivated criminal group that resells stolen access to large language models, a scheme known as "LLMJacking". Fireworks has not said how many customers were affected. It describes the impact as a "limited number of customer accounts" out of a customer base that The Record puts at more than 10,000. At least one large downstream customer, Notion, has confirmed that its own users' data was exposed.
What Happened
There were two intrusions, and they reached Fireworks by different routes.
Incident one (October 6). Fireworks detected misuse of internal company credentials at 9 a.m. PDT on October 6. The attacker used them to read environment variables in evaluation jobs for a limited number of customer accounts. Those variables included API keys and tokens stored as secrets. Fireworks began notifying customers on October 7. It rotated employee API keys on October 9, then revoked further user keys and rotated service-account tokens on October 10. It also revoked keys the attacker had created. Reports differ slightly on when the first bulletin went out: most coverage dates it October 9, while The Hacker News cites October 10. Crypto Briefing says it was published on the 9th and updated on the 10th, which would explain the gap. At that point Fireworks said it had found no access to customer models, datasets, training data, inference traffic or personal information.
Incident two (October 23–24). An unnamed third-party cloud provider that hosted Fireworks research and development machines was breached on October 23. "On October 24, the unauthorized third party used [the provider] to reach Fireworks development machines and then run an unauthorized workload that led to additional customer data impact," the company said. Fireworks says it detected the activity the same day and closed known critical vulnerabilities. It has seen no further successful access to its customer-facing platform since October 25.
The second incident is what changed the picture. The November 9 update reverses the earlier statement that customer models and datasets had not been touched.
What Was Taken
Fireworks sorts the exposed data into these categories, and The Register, BleepingComputer and The Hacker News all report the same breakdown:
- Secrets: API keys and tokens stored in environment variables (incident one).
- Resource metadata: Fireworks resource identifiers, display names, descriptions and creation times.
- Billing information: billing and shipping addresses, invoice and payment history, account balances and credit usage. Fireworks says it does not store payment card numbers, so card numbers were not exposed.
- Model weights and datasets: for certain customers, a subset of incomplete model weights and datasets.
Fireworks has not published a record count or a number of affected accounts, and no regulator filing has appeared. CEO Lin Qiao played down the model-weight exposure. He told The Register: "From what we see attackers are not after weights. Most downloads were partial and stopped."
The effects reach beyond Fireworks' own customers. Notion told The Record that it was notified on November 2, disconnected from Fireworks, and deleted all of its data held in Fireworks' systems. In a customer email shared by Render CEO Anurag Goel and reported by The Register, Notion said fewer than 1% of its workspaces may have been affected. It warned that "some unattributable chat sessions with Notion AI may have been exposed."
Why It Matters
This is a supply-chain breach at the AI inference layer. Businesses that build AI features on a hosted model provider pass their users' data through that provider. The Notion case shows that a breach at the provider can expose chats from an AI assistant used by organisations that have never heard of Fireworks.
The motive also matters. LLMJacking groups steal API keys and cloud credentials, then resell model access through illicit routing gateways. The victim pays for the compute. CyberSIXT reports that Fireworks pointed to a November 2 LLMJacking report from Google Threat Intelligence Group and Mandiant. Business Bearings, citing that research, says Mandiant has seen fraudulent usage charges of $100,000 to $1 million in separate cases, not involving Fireworks. Any keys exposed here can be directly turned into money. Customers who reused credentials elsewhere face fraudulent charges as well as data exposure.
Finally, the first disclosure understated the damage. A "contained" incident in early October became a much wider exposure a month later. Defenders should treat any vendor's first statement as provisional.
The Attack Technique
- Initial access (incident one): misuse of internal Fireworks credentials, leading to collection of secrets from evaluation-job environment variables. Fireworks has not said how those credentials were obtained.
- Initial access (incident two): a compromise at a third-party cloud provider hosting R&D machines, used as a pivot into Fireworks development systems.
- Execution: an unauthorized workload run on the development machines, which reached an internal application holding metadata, billing records, datasets and weights.
- Monetisation: resale of stolen LLM access tokens through illicit gateways, according to Fireworks' own attribution.
Fireworks has not named the criminal group or the cloud provider. Business Bearings reports that Fireworks disabled self-serve dataset uploads and downloads while the investigation continues. The company says further findings are possible.
What Organizations Should Do
- Rotate every credential shared with Fireworks. Replace API keys, cloud tokens and any secrets passed in as job environment variables, even if you have not been notified. Check whether those keys are reused anywhere else.
- Watch for LLMJacking signs. Look for unexpected spikes in model usage, calls from unfamiliar IP ranges or regions, and new keys or service accounts you did not create. Set hard spend caps and billing alerts with every model and cloud provider.
- Inventory your AI supply chain. List which vendors and sub-processors handle prompts, chat logs, fine-tuning data and model weights. Ask your SaaS vendors directly whether they route data through Fireworks.
- Keep long-lived secrets out of environment variables. Use short-lived, narrowly scoped credentials issued from a secrets manager. Assume anything readable inside a training or evaluation job can be stolen.
- Prepare for targeted phishing. Leaked billing addresses, invoice history and account balances give attackers what they need for convincing fake invoice and payment-change emails. Warn finance teams.
- Treat proprietary datasets and fine-tuned weights as crown-jewel assets. Keep minimal copies with third-party hosts, delete data after jobs finish, and write contracts that require prompt breach notification.
Sources: AI company Fireworks says hackers stole data, billing info during O... | Fireworks AI discloses new breach after cloud provider hack | Fireworks AI gets burned twice as customer data exposure widens | Fireworks AI Breach Widens to Expose Customer Billing Data and Inco... | Fireworks AI breach reached customer datasets and model weights | Fireworks AI Expands Breach Disclosure to Datasets and Model Weight... | Fireworks AI says October security incident exposed customer data a... | Fireworks AI Widens Data Breach Disclosure — Business Bearings