Fireworks AI widens breach disclosure to datasets, weights

By Nathan Brooks

Fireworks AI said on November 9, 2026 that attackers accessed account and billing information and, for a limited group of customers, secrets, datasets and incomplete model weights.

The AI infrastructure provider’s updated disclosure expanded an incident it first described in an October 9 bulletin as unauthorized use of internal credentials. Fireworks AI said an affected internal application exposed resource identifiers, display names, descriptions and creation times.

Billing records included billing and shipping addresses, invoice and payment history, account balances and credit usage. Fireworks AI said it does not store payment card numbers, so the incident did not affect those numbers.

Affected customers are receiving account-specific details and recommended responses, Fireworks AI said. Its ongoing investigation may produce additional findings.

The first incident and a second route

On October 6, 2026, Fireworks AI identified unauthorized use of internal credentials and began containment, the company said. An unauthorized party had accessed environment variables used in evaluation jobs in a limited number of customer accounts.

At that stage, Fireworks AI had not detected unauthorized access to customer models, datasets, training data, personal information or inference traffic within its security perimeter or control. Customer notifications began on October 7. Fireworks AI rotated employee API keys on October 9, then revoked additional user keys and rotated service-account tokens on October 10.

A separate route emerged after a third-party cloud provider hosting Fireworks AI research-and-development machines suffered a security incident on October 23, 2026. On October 24, the unauthorized party used that incident to enter Fireworks AI development machines and run an unauthorized workload, according to the company.

Fireworks AI detected the activity that day, remediated it and closed known critical vulnerabilities. As of October 25, the company said it had detected no further successful unauthorized access by the actor on the platform customers use.

Containment and forensic analysis

Fireworks AI said it notified law enforcement and engaged Palo Alto Networks Unit 42 for forensic analysis. Its response includes:

• Revoking and replacing credentials and service accounts.
• Removing unnecessary elevated privileges and restricting unauthorized network pathways.
• Isolating affected systems and tightening access to storage and analytics systems.
• Enhancing logging and monitoring.

What does this breach change for Fireworks AI customers?\n

Fireworks AI has disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training while the investigation continues. Training SDK remains available with zero data retention, meaning no training data is stored at rest. Fireworks Lab-based training remains isolated, with additional network and storage protections.

The company said it has detected no impact to Inference, Training SDK or Nexus, all zero data retention by default. That finding remains limited to the investigation to date.

Fireworks AI’s data-security documentation says it does not log or store open-model inference prompts or generations unless users explicitly opt in. Nexus does not store prompts, responses, code, tool calls or traces. It retains service metadata needed to operate the service and de-identifies that metadata after 30 days.

For notified customers, remediation now extends beyond replacing keys. Fireworks AI’s earlier guidance told them to:

• Replace revoked Fireworks API keys.
• Rotate identified third-party credentials with their issuing providers.
• Review associated logs and data.
• Check for unrecognized keys, users, evaluators, training jobs and datasets.

Fireworks AI warned that removing a stored secret does not invalidate the underlying third-party credential.

The resale market for stolen model access

Fireworks AI said its evidence links the activity to a financially motivated cybercriminal group seeking to sell unauthorized LLM access through illicit routing gateways, an activity known as LLMJacking.

Google Threat Intelligence Group and Mandiant described those gateways as “LLM Mixers” in research published November 2, 2026. The researchers said such services proxy, aggregate and resell unauthorized model access to underground subscribers. Some operations separate initial compromise from downstream monetization.

Across Mandiant’s separate investigations, fraudulent resource-consumption charges exceeded $100,000 in a single day in individual incidents. They reached $1 million cumulatively at some organizations before access was revoked. Mandiant said those figures describe the broader investigations, not Fireworks AI’s losses. Exposed or stolen cloud identity tokens were the dominant initial-access vector across the cases.

Google Threat Intelligence Group and Mandiant recommended:

• Centralized secrets management and least-privilege access.
• Routine configuration audits and spending controls.
• Monitoring for anomalous, low-volume requests that can validate stolen credentials without triggering volume-based alarms.

Fireworks AI’s credential replacement, privilege reduction and expanded monitoring align with several of those priorities. Its update also shows how a development-machine compromise can expose AI assets and disrupt the workflows used to build them.

Fireworks AI said the investigation may produce additional findings. For customers, the immediate change is operational: dataset transfers remain disabled while they replace credentials, review billing information and related logs, and assess the account-specific findings the company provides.