Fireworks AI Expands Breach Disclosure to Datasets and Model Weights

Fireworks AI on November 9, 2026 expanded its disclosure of an October security incident, reporting that attackers accessed account and billing information and, for a limited group of customers, secrets, datasets and incomplete model weights. The AI infrastructure provider had initially described the incident as unauthorized use of internal credentials.

The affected internal application provided access to resource metadata including identifiers, display names, descriptions and creation times. Billing information covered billing and shipping addresses, invoice and payment history, account balances and credit usage. Fireworks does not store payment card numbers, which were not affected. Customers whose data was impacted are receiving account-specific details and recommended responses, and the ongoing investigation may produce additional findings.

Development Machines Provided Another Route

The update goes beyond Fireworks’ original October 9, 2026 bulletin. On October 6, 2026, the company identified unauthorized use of internal credentials and began containment. An unauthorized party had accessed environment variables used in evaluation jobs in a limited number of customer accounts. At that stage, Fireworks had not detected unauthorized access to customer models, datasets, training data, personal information or inference traffic within its security perimeter or control.

Customer notifications began on October 7, 2026. Fireworks rotated employee API keys on October 9 and revoked additional user keys and rotated service-account tokens on October 10, 2026. The later activity took a different path: a third-party cloud provider hosting Fireworks research-and-development machines experienced a security incident on October 23, 2026.

On October 24, 2026, the unauthorized party used that incident as a route into Fireworks development machines and ran an unauthorized workload, leading to the additional customer-data impact. Fireworks detected the activity that day, took remediation measures and closed known critical vulnerabilities. The company said that as of October 25, 2026, it had not detected further successful unauthorized access by the actor on the platform customers use.

Dataset Operations Temporary Restrictions

Fireworks notified law enforcement and engaged Palo Alto Networks Unit 42 for forensic analysis. Fireworks’ response has included revoking and replacing credentials and service accounts, removing unnecessary elevated privileges, restricting unauthorized network pathways, isolating affected systems, tightening access to storage and analytics systems, and enhancing logging and monitoring.

Some customer-facing operations are also restricted. Self-serve dataset uploads and downloads used by Batch Inference and dataset-based training are disabled while the investigation continues. Training SDK remains available with zero data retention, meaning no training data is stored at rest. Fireworks Lab-based training operates in an isolated environment with additional network and storage protection.

No impact has been detected to Inference, Training SDK or Nexus, all of which are zero data retention by default, but that finding is limited to the investigation to date. Fireworks’ data-security documentation says open-model inference prompts and generations are not logged or stored without explicit user opt-in. Nexus does not store prompts, responses, code, tool calls or traces, although it retains service metadata needed to operate the service and de-identifies it after 30 days.

Fireworks’ earlier guidance told notified customers to replace revoked Fireworks API keys, rotate identified third-party credentials with their issuing providers, review associated logs and data, and check for unrecognized keys, users, evaluators, training jobs and datasets. Removing a stored secret alone does not invalidate the underlying third-party credential.

The LLMJacking Resale Market

Fireworks said its evidence links the activity to a financially motivated cybercriminal group aiming to sell unauthorized LLM access through illicit routing gateways, an activity known as LLMJacking. The company cited November 2, 2026 research from Google Threat Intelligence Group and Mandiant that describes LLM Mixers as illicit gateways that proxy, aggregate and resell unauthorized model access to underground subscribers. Some operations divide initial compromise from downstream monetization.

The researchers reported that across Mandiant’s separate investigations, observed fraudulent resource-consumption charges exceeded $100,000 in a single day in individual incidents and reached $1 million cumulatively at some organizations before access was revoked. Those figures describe the broader investigations, not Fireworks’ losses. Exposed or stolen cloud identity tokens were the dominant initial-access vector across those cases.

The researchers recommend centralized secrets management, least-privilege access, routine configuration audits, spending controls and monitoring for anomalous, low-volume requests that can validate stolen credentials without triggering volume-based alarms. Fireworks’ credential replacement, privilege reduction and expanded monitoring align with several of those defensive priorities, while its update also exposes the risks surrounding development machines and third-party infrastructure.

For Fireworks customers, the response now extends beyond replacing keys to assessing billing information and, for the limited group, datasets and unfinished model assets. With dataset transfers still disabled and the investigation ongoing, the incident ties a development-environment compromise to both exposure of AI assets and disruption of the workflows used to build them.