Fireworks AI gets burned twice as customer data exposure widens

Summary

Fireworks AI disclosed two October 2026 security incidents, with the later account substantially widening the reported customer-data exposure. In the first incident, detected on October 6 and disclosed on October 9, attackers used internal credentials and accessed evaluation-job environment variables containing some customers' API keys and tokens. Fireworks initially reported no evidence of access to models, datasets, training data, inference traffic, or personal information.^[0]

The second incident followed the October 23 compromise of an unnamed third-party cloud provider hosting Fireworks research and development machines. Attackers used that access on October 24 to reach Fireworks development systems and run an unauthorized workload. The expanded disclosure covered resource metadata; billing and shipping addresses, invoice and payment histories, balances, and credit usage; and access to a subset of incomplete model weights and datasets for certain customers. Payment card numbers were reportedly unaffected because Fireworks does not store them.^[0]

Potential downstream exposure included Notion AI conversations. The Register reproduced a notification, shared by Render's CEO, saying Render was among fewer than 1 percent of Notion workspaces potentially affected and that some chat sessions may have been exposed. Notion said the transcripts lacked separate user or workspace attribution and that no other workspace data was affected, but the article noted that conversations themselves could contain identifying details. These statements describe potential exposure, not confirmed disclosure of every affected workspace's chats.^[0]

Fireworks suspected financially motivated LLMJacking activity involving the resale of unauthorized access to AI models; no named threat actor was identified. Its CEO assessed that stealing model weights was not the apparent objective and said most downloads were partial and stopped. Fireworks reported remediation with Unit 42, including credential rotation, system isolation, and tighter storage access and monitoring. The total number of affected customers remained undisclosed in the supplied report, and all findings here depend on that single reporting source.^[0]

Attack chain

1. Second incident: third-party infrastructure compromise: On October 23, 2026, attackers compromised the unnamed cloud provider hosting Fireworks research and development machines. The report does not explain how the provider was initially compromised.^[0]
2. Second incident: development-system access and unauthorized execution: On October 24, attackers used the provider access to reach Fireworks development systems and run an unauthorized workload. The report does not provide an execution technique or a detailed sequence connecting workload execution to each category of exposed customer data.^[0]

Disclosure timeline

Key takeaways

• Keep the two incident scopes distinct: the first disclosure concerned credential and evaluation-environment exposure, while the later account described third-party infrastructure compromise and substantially broader customer-data access.^[0]
• Treat the LLMJacking explanation as a suspected motive. The CEO's assessment that model weights were not the objective does not negate the separately reported access to incomplete weights and datasets.^[0]
• The Notion notification illustrates potential downstream exposure through an AI service provider. Its fewer-than-1-percent figure applies to Notion workspaces potentially affected, not to Fireworks' overall customer population.^[0]
• The evidence supports operational containment and credential remediation, not a version-specific patch recommendation. No underlying software flaw, affected version range, actionable attacker indicator, or named actor is supplied in the report.^[0]

Defensive actions

• Rotate exposed customer API keys and tokens, along with credentials associated with the affected Fireworks environments.: The first incident exposed evaluation-job environment variables containing customer secrets. Credential rotation was also an explicitly reported component of Fireworks' remediation.^[0]
• Isolate affected development systems from the network during containment.: Attackers reached Fireworks development systems through the compromised provider and ran an unauthorized workload. Network isolation of affected systems was part of the reported response.^[0]
• Tighten access controls and monitoring for affected data-storage resources.: The later disclosure included metadata, billing records, and access to incomplete model weights and datasets. Fireworks specifically reported strengthening data-storage access and monitoring as remediation.^[0]
• Conduct a customer-specific exposure review covering resource metadata, billing records, datasets, and model artifacts rather than relying on the first disclosure's narrower findings.: The later disclosure materially broadened the exposed-data categories, and the report said Fireworks was working with customers to assess impact. It did not provide a complete affected-customer count.^[0]
• For Notion workspaces notified of potential exposure, include sensitive and identifying information within AI conversation text in the impact assessment.: The reproduced notification said some chat sessions may have been exposed without separate attribution metadata. That limitation does not exclude identifying details contained within the conversations themselves.^[0]