Fireworks AI extends breach disclosure to datasets and model weights – Unite.AI

Fireworks AI on November 9, 2026 expanded the disclosure of an October security incident, reporting that attackers accessed account and billing information and, for a limited group of customers, secrets, datasets and incomplete model weights. The AI ​​infrastructure provider had initially described the incident as an unauthorized use of internal credentials.

The affected internal application provided access to asset metadata, including identifiers, display names, descriptions, and creation times. The billing information included billing and shipping addresses, invoice and payment history, account balances, and credit usage. Fireworks does not store payment card numbers, which were not affected. Customers whose data was affected are receiving specific account details and recommended responses, and the ongoing investigation may yield additional findings.

Development machines provided another avenue

The update goes beyond the original Fireworks bulletin of October 9, 2026. On October 6, 2026, the company identified the unauthorized use of internal credentials and initiated containment. An unauthorized party had accessed environment variables used in evaluation processes in a limited number of customer accounts. At that stage, Fireworks had not detected unauthorized access to customer models, datasets, training data, personal information, or inference traffic within its security perimeter or control.

Notifications to customers began on October 7, 2026. Fireworks rotated employee API keys on October 9, and revoked additional user keys and rotated service account tokens on October 10, 2026. Subsequent activity took a different path: a third-party cloud provider hosting Fireworks R&D machines experienced a security incident on October 23, 2026.

On October 24, 2026, the unauthorized party used the incident as a gateway into Fireworks development machines and executed an unauthorized workload, further impacting customer data. Fireworks detected the activity that day, took corrective measures, and closed known critical vulnerabilities. The company said that as of October 25, 2026, it had detected no further successful unauthorized access by the actor on the platform used by customers.

Temporary restrictions on dataset operations

Fireworks notified law enforcement and engaged Palo Alto Networks Unit 42 for a forensic analysis. Fireworks’ response included revoking and replacing credentials and service accounts, removing unnecessary elevated privileges, limiting unauthorized network locations, isolating affected systems, restricting access to storage and analytics systems, and improving logging and monitoring.

Some customer-facing operations are also limited. Self-service dataset uploads and downloads used by Batch Inference and dataset-based training are disabled while the investigation continues. The training SDK remains available without data retention, meaning no training data is stored idle. Fireworks Lab-based training operates in an isolated environment with additional network and storage protection.

There was no impact on Inference, Training SDK, or Nexus, all of which default to zero data retention, but this finding is limited to the investigation to date. The Fireworks data security documentation states that open model prompts and inference builds are not logged or stored without the user’s explicit consent. Nexus does not store requests, responses, codes, tool calls, or traces, although it does retain the service metadata needed to operate the service and anonymizes it after 30 days.

Previous Fireworks guidance urged notified customers to replace revoked Fireworks API keys, rotate identified third-party credentials to the vendors that issued them, review logs and associated data, and check for unrecognized keys, users, raters, training processes, and datasets. Removing an archived secret alone does not invalidate the underlying third-party credential.

The LLMJacking Resale Marketplace

Fireworks said evidence links the business to a financially motivated cybercriminal group that aims to sell unauthorized LLM access through illicit routing gateways, an activity known as LLMJacking. The company cited November 2, 2026 research from Google Threat Intelligence Group and Mandiant that describes LLM mixers as illicit gateways that proxy, aggregate, and resell access to unauthorized templates to clandestine subscribers. Some deals split the initial tradeoff from downstream monetization.

Researchers reported that during Mandiant’s separate investigations, they observed that fraudulent charges for resource consumption exceeded $100,000 in a single day in individual incidents and reached $1 million overall at some organizations before access was revoked. These figures describe the broader investigations, not Fireworks losses. Exposed or stolen cloud identity tokens were the dominant initial access vector in these cases.

The researchers recommend centralized secrets management, least privilege access, routine configuration checks, spending controls, and monitoring of anomalous and low-volume requests that can validate stolen credentials without triggering volume-based alarms. Fireworks’ credential replacement, privilege reduction, and expanded monitoring align with many of these defensive priorities, while its update also exposes risks related to development machines and third-party infrastructure.

For Fireworks customers, the response now extends beyond key replacement to evaluating billing information and, for a limited group, unfinished datasets and model assets. With dataset transfers still disabled and the investigation ongoing, the incident links a compromise of the development environment to both the exposure of AI assets and the disruption of the workflows used to build them.