Fireworks AI widens breach disclosure: datasets, partial model weights and billing data were accessed

Fireworks AI, a company that runs and fine-tunes AI models for other businesses, updated its security bulletin on November 9, 2026. It now says an October 24 intrusion reached customer billing records and, for a limited set of accounts, stored secrets, datasets and incomplete model weights. If your team uses Fireworks, read any notice you got from them, rotate the credentials it lists, and check your account for keys, users, jobs or datasets you don't recognize.

What happened, in plain English

Fireworks is an inference provider: companies send it AI models and data, and it runs those models on its graphics processors (GPUs) so the companies don't have to buy the hardware. Customers can also store secrets there, meaning passwords and API keys (the long strings that let one program log into another service), so their AI jobs can reach other systems.

Fireworks has had two incidents in a few weeks:

• October 6, 2026: someone misused internal Fireworks credentials and read environment variables (settings handed to a running program, often including keys) from evaluation jobs in a limited number of customer accounts. Fireworks disclosed this on October 9 and revoked and rotated keys.
• October 23–24, 2026: a third-party cloud provider that hosted Fireworks research machines had its own security incident. On October 24, an unauthorized party used that opening to reach Fireworks development machines and run an unauthorized workload. Fireworks says it detected this the same day.

The November 9 update says the second intrusion exposed resource metadata (names, descriptions, creation dates) and billing information (addresses, invoice and payment history, balances, credit usage). For a limited set of accounts it also exposed secrets, datasets and "a subset of incomplete model weights". Weights are the learned numbers that make up a trained model. Fireworks says it doesn't store card numbers, so those were not affected.

Think of a storage company whose staff badge was copied. First the intruder read the notes taped inside a few lockers. Later they got in through the building next door, and this time they also looked at the account ledger and some of the boxes.

Are you affected? What to do now

If your organization has never used Fireworks, there's nothing to do for this incident. The broader lesson about where you keep AI-related secrets is covered in the expert view below.

If you use Fireworks, directly or through a vendor:

• Look for a Fireworks incident notice. Fireworks says it is contacting customers whose data was affected, with account-specific details and recommended steps. Search mail for messages from Fireworks since October 7. For questions, the bulletin names security-notice@fireworks.ai.
• Replace revoked Fireworks API keys and update the applications that use them. Revoked keys simply stop working, so a sudden failure to log in may be the first sign.
• Rotate every third-party credential you stored as a Fireworks secret, and do it at the service that issued it (cloud provider, database, other AI provider). Fireworks warns that deleting the stored copy does not revoke the credential itself.
• Review activity on those third-party services (access logs, billing, data reached with the exposed keys), even if nothing looks wrong yet.
• Audit your Fireworks account for unrecognized API keys, users, evaluators, training jobs and datasets. Report anything odd to Fireworks.
• Check the data you uploaded. If you put training or evaluation datasets on Fireworks, assess whether they contained personal or confidential data. Bring in your privacy or legal team, because notification duties (for example under the GDPR) depend on what was in them and on your contracts.
• Plan around the feature pause. Self-serve dataset uploads and downloads for Batch Inference and dataset-based training are disabled while the investigation continues. Fireworks says the Training SDK is still available.
• Ask your suppliers. If a SaaS vendor runs its AI features on Fireworks, ask whether any of your data was in the affected accounts.

Fireworks reports no detected impact to its Inference, Training SDK and Nexus services, which it says keep no data by default (zero data retention). It also says the investigation is still active.

The expert view

The likely motive is resale of AI access. Fireworks says the evidence links the activity to a financially motivated cybercriminal group that sells access tokens from unauthorized large language model (LLM) use to illicit routing gateways. Its bulletin cites research by Google Threat Intelligence Group and Mandiant, published November 2, 2026, on LLMjacking: stealing an organization's access to AI models and reselling it. We covered that report on November 6. Mandiant describes "LLM mixers" that pool stolen keys and sell cheap access, with some victims billed more than $100,000 in a day. Those figures come from Mandiant's wider investigations, not from Fireworks.

Two caveats. Fireworks does not name the group. And it never says outright that the October 6 and October 24 incidents were the work of the same actor.

Why this matters beyond one vendor. An AI platform often holds more than model access. Evaluation and fine-tuning jobs need to reach other systems, so customers hand the platform credentials for their own cloud, data warehouses and other AI providers. That makes the platform a place where many companies' keys sit side by side. For a group that makes money from AI access, stored third-party keys are worth more than the platform itself, and the October 6 incident was about exactly those secrets.

What is new and what isn't. Credential theft through a supplier is an old pattern. What's newer is the target and how fast the stolen access turns into money: stolen LLM access can be resold through gateways in hours. The October 24 path, a breach at the cloud provider hosting the vendor's research machines, is classic fourth-party risk. Your vendor's vendor became the way in.

Model weights. For a limited set of accounts, partial model weights were accessed. For a customer who fine-tuned a model on its own data, those weights are both intellectual property and a possible privacy issue, because a trained model can sometimes reveal parts of its training data. "Incomplete" probably limits how useful the stolen copies are, but Fireworks doesn't say what the word means. Customers in that group should ask.

What to change structurally.

• Give an AI platform only short-lived, narrowly scoped credentials.
• Set spending caps and per-model quotas on every AI API key, so a stolen key can't run up a six-figure bill.
• Treat "a new AI service was switched on" or "a key was created" in cloud audit logs as high-priority alerts. Google and Mandiant recommend this.
• Keep an inventory of which AI vendors hold which of your secrets, so you can rotate within hours, not days.

Still unknown: how many accounts were affected, which cloud provider was breached and how, whether stolen tokens were actually resold, and how the October 6 credential misuse started. Fireworks says more findings may emerge. Its investigation is supported by Palo Alto Networks Unit 42, and law enforcement has been notified.

Official sources

• Fireworks AI — October 2026 Security Incident Update (last updated November 9, 2026)
• Fireworks AI — October 2026 Security Incident (original bulletin, October 9–10, 2026)
• Google Threat Intelligence Group & Mandiant — LLMjacking: monetizing compromised cloud models (November 2, 2026)
• Coverage: Unite.AI — Fireworks AI expands breach disclosure to datasets and model weights
• Coverage: Cyber Security News — Hackers breach Fireworks AI through third-party cloud provider
• Coverage: AI Cyber Brief — Google and Mandiant: stolen cloud AI access is being resold