Fireworks AI Hacked Twice in Weeks as Customer Data and Model Weights Exposed
Fireworks AI says hackers reached customer billing records, datasets and unfinished model weights in a second October intrusion, weeks after its first breach.
Image: Wikimedia Commons / BalticServers.com
Nov 10 — Fireworks AI said on November 9 that hackers reached customer billing records, datasets and a subset of unfinished model weights in a second intrusion in October, widening a breach the artificial intelligence infrastructure company first disclosed last month.
The updated security bulletin describes two separate intrusions weeks apart. The first began on October 6, when Fireworks detected unauthorised use of internal credentials. The second started on October 23, when a third-party cloud provider hosting Fireworks research machines suffered its own security incident, and reached Fireworks development machines the next day.
Key Takeaways
- Hackers reached account and billing information, and for a limited set of accounts, secrets, datasets and a subset of incomplete model weights.
- The second intrusion began on October 23 at a third-party cloud provider, reaching Fireworks development machines the next day.
- Payment card numbers were not stored by Fireworks and were not affected; the company found no impact on its Inference, Training SDK or Nexus services.
- Fireworks says the evidence points to a financially motivated group selling unauthorised access to language models through illicit routing gateways.
Two intrusions, one investigation
| Date | Event |
|---|---|
| October 6, 2026 | Fireworks detects unauthorised use of internal credentials |
| October 23, 2026 | Third-party cloud provider hosting Fireworks research machines is breached |
| October 24, 2026 | Intruder reaches Fireworks development machines and runs an unauthorised workload |
| November 9, 2026 | Fireworks publishes an updated security bulletin disclosing the wider impact |
Fireworks said attackers misused internal credentials to reach environment variables used by evaluation jobs, which can hold API keys and tokens for a limited number of accounts. The company began notifying affected customers on October 7 and revoked the affected keys and credentials.
The second intrusion took a different route. Fireworks said a third-party cloud provider that hosted its research and development machines experienced a security incident on October 23. The next day, an unauthorised party used that opening to reach Fireworks development machines and run an unauthorised workload that exposed further customer data. Fireworks said it detected the activity the same day and closed known critical vulnerabilities. Fireworks said the evidence points to a financially motivated group selling unauthorised access to language models through illicit routing gateways, a practice known as LLMjacking.
The affected application exposed resource identifiers, names, descriptions and creation times. Billing information included billing and shipping addresses, invoices, payment history, balances and credit usage. For a limited set of accounts, attackers also reached secrets, datasets and a subset of incomplete model weights. The disclosure does not establish that complete production models were taken. Fireworks said it has found no impact on Inference, the Training SDK or Nexus.
The breach has already reached some of the platform's best-known customers. Notion said fewer than 1 percent of its workspaces were affected and that the exposed data included Notion AI chat transcripts used for a feature called Insights. Notion said it disconnected its systems from Fireworks on November 3 and disabled the Insights feature. Fireworks said it is working directly with affected customers, including Notion and Cursor.
Fireworks has disabled self-service dataset uploads and downloads for Batch Inference and dataset-based training while the investigation continues. The Training SDK remains available. Its guidance to affected customers is to replace revoked Fireworks keys, rotate any exposed third-party credentials with their issuing providers and review access logs and datasets for unauthorised activity. The company has notified law enforcement and brought in Palo Alto Networks Unit 42 for forensic support.
It is the company's second known hack in weeks, as the wider AI build-out faces mounting scrutiny. SoftBank swung to a $7.1 billion quarterly loss. Competition among AI chip and cloud providers has also intensified, with Google unveiling new AI chips aimed at Nvidia's dominance. Regulators are tightening oversight too — Australia announced mandatory safeguards and a new AI safety regulator.
Frequently Asked Questions
What data did the Fireworks AI breach expose?
Account and billing information, including invoices, payment history and credit usage. For a limited set of accounts, secrets, datasets and a subset of incomplete model weights were also exposed.
Were payment card numbers stolen?
No. Fireworks does not store payment card numbers, and they were not affected.
What should Fireworks AI customers do now?
Replace revoked Fireworks keys, rotate exposed third-party credentials with their issuing providers, and review access logs and datasets for unauthorised activity.
Fireworks said its investigation is ongoing, and it has not yet said when it expects to publish its next update.
