Fireworks AI Says Second Breach Reached Customer Datasets and Model Weights

TL;DR

Fireworks AI told customers on Nov 9 that its October security incident was larger than the bulletin it published on Oct 9. An Oct 24 intrusion entered through a third-party cloud provider that hosted Fireworks R&D machines, reached Fireworks development machines, and ran an unauthorized workload there. The company now says an internal application gave the intruder access to account and billing information, and for a limited set of accounts, secrets, datasets, and incomplete model weights. It is the second incident Fireworks has disclosed in weeks, and the company links the activity to a financially motivated crew running LLMJacking.

Two bulletins, one month

The first bulletin, published Oct 9, read as a contained credential spill. On Oct 6 Fireworks identified unauthorized use of internal Fireworks credentials. Environment variables used in evaluation jobs, including API keys and tokens, were captured in a limited number of customer accounts. At the time, Fireworks said it had found no evidence of unauthorized access to customer models, datasets, training data, or inference traffic within its security perimeter. Employee API keys were rotated Oct 9, with more revocations Oct 10.

The Nov 9 update changed the picture twice. The investigation found impacts the original bulletin missed: account and billing information, and for a limited set of accounts, secrets, datasets, and incomplete models. And there was a second, separate intrusion. On Oct 23 a third-party cloud provider hosting Fireworks R&D machines had its own security incident. On Oct 24 an unauthorized party used that opening to reach Fireworks development machines and run an unauthorized workload. Fireworks detected the activity the same day and says it has found no successful unauthorized access on the customer platform since Oct 25.

Which cloud provider? Not named. If your own stack has the same shape, you cannot check whether your suppliers' suppliers hold your data.

What the intruder could reach

The affected internal application exposed resource metadata such as identifiers, display names, and creation times, plus billing information: billing and shipping addresses, invoice and payment history, account balances, and credit usage. Payment card numbers were never stored, so they were never at risk.

For certain customers, a subset of incomplete model weights and datasets was accessed. The company has not said how many customers, which customers, or how much material. On the clean side of the ledger, Fireworks reports no detected impact to Inference, Training SDK, or Nexus, services it describes as zero data retention by default.

The part you cannot rotate

An API key rotates in an afternoon. A dataset of support transcripts, or a half-trained checkpoint that encodes it, has no rotate button. If your pipeline relied on dataset-based training or Batch Inference, this is the sentence to reread: self-serve dataset uploads and downloads are disabled while the investigation runs.

Training SDK remains available with no training data stored at rest, and Lab-based training runs in an isolated environment with extra network and storage protections. Anything mid-flight through the disabled path pauses until Fireworks says otherwise.

LLMJacking, briefly

Fireworks links the activity to a financially motivated cybercriminal group and frames the goal as LLMJacking: selling tokens from unauthorized access to LLMs to illicit routing gateways. Fireworks notified law enforcement and brought in Palo Alto Networks Unit 42 for forensics. On Nov 2, Google Threat Intelligence Group and Mandiant published a post on the rise of exactly this scheme, its motives, its techniques, and mitigations.

Picture a stolen streaming account resold on a gray market, except the commodity is GPU tokens and the bill lands on someone else's cloud account.

If you build on managed AI platforms

• Ask where training artifacts live. On Fireworks, the zero-retention surfaces (Inference, Training SDK, Nexus) report no impact; the dataset-based training path was exposed. That split probably maps onto other providers too.
• Rotate third-party credentials, not just platform keys. Fireworks' own action list from October says removing a stored secret does not invalidate the underlying credential; you have to rotate it with the provider that issued it.
• Count eval and R&D infrastructure in your threat model. The first intrusion came through evaluation jobs, the second through a supplier's machines. Neither touched the inference API.
• Billing metadata is a leak. Invoice history plus a resource inventory is quieter than weights, and a competitor reading it still learns your usage patterns and scale.

Caveats

Every material fact above comes from Fireworks' own two bulletins, based on its investigation with Unit 42, and the Nov 9 bulletin says the investigation is ongoing and may reveal more. The company has not disclosed how many customers were affected or how much data was taken, and the model weights are described as incomplete. No affected customer has described impact publicly. Press coverage, including RuntimeWire and Data Phoenix, adds reporting but no independent verification beyond the bulletins.

Key Takeaways

• Fireworks AI's Nov 9 update says an Oct 24 intrusion through a compromised third-party cloud provider reached Fireworks development machines, exposing account and billing data, and for a limited set of accounts, secrets, datasets, and incomplete model weights.
• It is the second disclosed incident in weeks: on Oct 6, misused internal credentials captured API keys and tokens from evaluation jobs, and the Oct 9 bulletin had reported no customer model or dataset access.
• No detected impact to Inference, Training SDK, or Nexus, all zero data retention by default, and payment card numbers are not stored.
• Fireworks links the activity to a financially motivated LLMJacking crew reselling unauthorized LLM tokens through illicit routing gateways; Unit 42 is assisting and law enforcement has been notified.
• Self-serve dataset uploads and downloads for Batch Inference and dataset-based training are disabled while the investigation continues.
• Rotate any third-party credential a platform stored on your behalf; deleting the stored copy does not revoke the credential itself.

Sources: Fireworks AI Nov 9 incident update, Fireworks AI October security bulletin, RuntimeWire, Data Phoenix, Google Threat Intelligence Group on LLMJacking