Fireworks AI Breach Widens: Attackers Took Customer Datasets, Secrets and Partial Model Weights After Pivoting Through a Hacked Cloud Provider
Fireworks AI's updated disclosure says a second October intrusion through a breached third-party cloud provider reached customer datasets, billing data, secrets and some partial model weights, and Notion has cut ties with the service.
AI inference platform Fireworks AI has expanded its account of a breach it first disclosed in October. The company now says attackers stole customer datasets, account and billing data, secrets and internal data. For some customers, they also took partial model weights. The latest update, published on 9 November 2026, describes a second intrusion through a third-party cloud provider that was much more serious than the first.
Fireworks has hired Palo Alto Networks' Unit 42 for the forensic investigation and has notified law enforcement.
What Happened
Fireworks hosts and fine-tunes open-weight AI models for enterprises and has more than 10,000 customers. According to its notice, there were two separate incidents.
Incident one (discovered 6 October): attackers stole environment variables and secrets, including API keys and tokens, from evaluation jobs belonging to a limited number of customer accounts. Unit 42's investigation attributes this first breach to a financially motivated cybercriminal group.
Incident two (late October): on 23 October, a third-party cloud provider that hosted Fireworks' research and development machines was itself attacked. On 24 October, the attacker used that foothold to reach Fireworks development machines and run an unauthorized workload there. Fireworks says this caused "additional customer data impact".
What Was Taken
Fireworks lists the following data as accessed or stolen:
- account information and billing details, including invoices and payment history
- secrets (credentials that grant access to users or applications)
- internal Fireworks data
- some customer datasets and other AI-related data
- partial model weights for certain customers
The company says it has no confirmed theft of complete production models. It also says payment card numbers were not stored and were not affected. Its Inference, Training SDK and Nexus products, which are zero-data-retention by default, were not affected either.
Fireworks says a "limited number of customer accounts" were affected and that all of them have been notified. It has not published a count.
Customer Fallout
Productivity company Notion said Fireworks notified it of the incident on 2 November and told it on 6 November that its customers' data may have been accessed. Notion had used Fireworks for classification jobs behind its Insights feature and to serve open-weight models. In response it has:
- disconnected from Fireworks and deleted data held there
- disabled the Insights feature
- stopped serving open-weight models through Fireworks
- started its own investigation
Separately, at least two Fireworks customers say they have moved substantial business elsewhere over concerns about security and communication.
The LLMjacking Connection
Fireworks attributes the activity to LLMjacking: stealing access to AI models and compute, then using or reselling it. Google's threat intelligence and Mandiant teams have described the same trend this year. They say attackers mainly target tokens and credentials, some groups sell initial access to others, and fraudulent model charges in single incidents have exceeded $100,000 in one day.
The Fireworks case shows LLMjacking moving beyond running up bills on stolen keys. Platforms that store fine-tuning datasets and custom weights hold valuable intellectual property. An attacker who gets into training infrastructure can take that too.
Who Is Affected
- Fireworks customers who were notified directly. Fireworks says unnotified accounts were not affected, but its investigation is still ongoing and could find more.
- Downstream users of products built on Fireworks, such as Notion users whose content was processed through Insights.
- Any organisation whose API keys or tokens were stored in Fireworks evaluation jobs or environment variables.
What To Do Now
If your organisation uses Fireworks, or any hosted fine-tuning or inference provider:
- Rotate keys and credentials stored with the platform, including Fireworks API keys and any third-party secrets passed in as environment variables, such as cloud, database or SaaS tokens.
- Review access logs for unfamiliar IP addresses, new API keys, unexpected deployments or jobs you did not start.
- Audit training and evaluation jobs and datasets for unauthorized reads, copies or changes.
- Assess model-weight exposure. If custom fine-tunes were affected, consider what a competitor or attacker could learn from them, and whether training data could be extracted.
- Minimise what you upload. Use zero-data-retention modes where available, and avoid putting long-lived production secrets into evaluation or training environments.
- Watch AI spend for sudden usage spikes, the classic sign of stolen model access.
Why It Matters
AI platforms are becoming concentrated stores of customer data, credentials and proprietary models, and their supply chains include their own cloud providers. In this case, the attacker reached Fireworks through a breach at a provider it relied on, then pivoted into development machines that held customer material.
For enterprises, the lesson is that AI vendors need the same third-party risk review as any other processor of sensitive data. That review should cover where fine-tuning data and weights live, which sub-processors host them, and how quickly the vendor will say what was taken. Fireworks' disclosure grew over five weeks, from leaked secrets to datasets and model weights, and Unit 42's work is not finished.
