Fireworks AI breach findings now include customer billing records, stored secrets, datasets and incomplete model weights, substantially widening an October incident that the infrastructure provider initially described as limited to evaluation-job credentials. The company says a financially motivated group sought to resell stolen access to large language models.

 

A second intrusion reached Fireworks development machines through an unnamed cloud provider on October 24. Notion separately confirmed that AI chat transcripts from fewer than 1% of its workspaces were affected, establishing a downstream impact beyond Fireworks’ own systems and forcing changes to Notion’s AI services.

 

The updated disclosures establish four material consequences:

  • Account and billing information was accessed.
  • Some datasets and incomplete models were exposed.
  • Notion disabled Insights and left Fireworks-based inference.
  • Fireworks suspended self-service dataset transfers.

 

Fireworks AI Breach Findings Expand Beyond Stored Secrets

Fireworks detected unauthorized use of internal credentials on October 6. Its original bulletin said environment variables containing API keys and tokens had been captured in a limited number of customer accounts, while investigators had found no evidence of access to models, datasets or personal information.

 

The company’s November 9 update changes that assessment. Investigators found that the affected internal application exposed resource metadata and billing information, including addresses, invoice and payment history, account balances and credit usage. Fireworks does not store payment-card numbers and says they were not affected.

 

For a limited set of accounts, Fireworks also identified exposure involving stored secrets, datasets and portions of incomplete model weights. The company has not disclosed the number of affected customers, the volume of data taken or which model projects were involved. Its investigation remains active and may produce additional findings.

 

Fireworks says it found no impact to its Inference, Training SDK or Nexus services, which use zero data retention by default. That distinction narrows the known scope, but it does not erase the exposure in evaluation, development and dataset workflows where customers intentionally stored material for later use.

 

A Cloud Provider Incident Opened a Second Path

Fireworks also disclosed that a third-party cloud provider hosting research and development machines suffered a security incident on October 23. The next day, an unauthorized party used that access to reach Fireworks development systems and run a workload that caused further customer-data impact.

 

The company says it detected the October 24 activity that day, remediated known critical vulnerabilities and has seen no further successful unauthorized access since October 25. It notified law enforcement and engaged Palo Alto Networks Unit 42 for forensic analysis and security hardening.

 

Remediation has included replacing credentials and service accounts, removing unnecessary elevated privileges, isolating affected systems, restricting network routes and improving logging. Fireworks also disabled self-service uploads and downloads for Batch Inference and dataset-based training while the investigation continues.

 

Recorded Future News independently reported the two incidents and the expanded data categories. The update remains preliminary: Fireworks has not named the cloud provider, published a forensic report or stated whether the same access path was involved in both October events.

 

Related Research

 

Notion Confirms Exposed AI Chat Transcripts

Notion’s security advisory says fewer than 1% of its workspaces were affected. Fireworks first notified Notion on November 2 about synthetic testing data, prompting Notion to disconnect its systems, delete its Fireworks-held data and stop communication with the provider by November 3.

 

Fireworks notified Notion on November 6 that potential customer data may also have been accessed. On November 8, it confirmed a dataset containing Notion AI chat transcripts used by the Insights feature. Notion says most transcripts lacked labels linking them to a user or workspace and did not include tool-call results.

 

The transcript text could still contain information supplied by users. Notion told affected customers to treat the material as exposed and rotate passwords, API keys or other credentials pasted into chats. It disabled Insights and stopped serving open-weight models through Fireworks while its own investigation continues.

 

The response shows how a breach at an AI infrastructure vendor can propagate into products that customers perceive as separate services. Enterprises may need inventories that map which prompts, datasets, credentials and model artifacts each provider stores, along with tested procedures for isolating a vendor without disabling unrelated workloads.

 

LLMJacking Turns Model Access Into a Resale Business

Fireworks says the evidence points to a financially motivated group engaged in LLMJacking: stealing credentials or model access, then routing that capacity through illicit gateways for paying customers. The company has not publicly named the group or supplied technical indicators that would permit independent attribution.

 

Google Threat Intelligence Group and Mandiant describe a growing division of labor between groups that obtain access and operators of “LLM Mixers” that aggregate and resell stolen quotas. Their 2026 cases produced fraudulent usage above $100,000 in one day and up to $1 million cumulatively.

 

Those figures describe Mandiant’s broader casework, not confirmed losses at Fireworks or its customers. They illustrate why exposed API keys and routing middleware attract criminals: high-value inference can be consumed quickly, monetized remotely and distributed across multiple stolen accounts before ordinary billing alerts trigger.

 

For Fireworks customers, the immediate controls are specific. Affected organizations should rotate every credential named in their notice with the original issuer, review logs for unauthorized reads and resource creation, examine unfamiliar evaluators or datasets, and treat model artifacts stored in the affected workflows as potentially accessed.

 

The remaining questions are equally concrete: how many customers were affected, what the cloud-provider failure allowed, whether data was copied or merely viewed, and whether the hardening measures prevent the original paths from reopening. Fireworks’ promised updates and any customer disclosures will determine the final scope.

 

Illustrative feature photograph: server racks at the National Energy Research Scientific Computing Center, photographed by Derrick Coetzee and sourced from Wikimedia Commons under the CC0 1.0 public-domain dedication. The image does not depict Fireworks AI or the affected systems; it was cropped and resized.