Fireworks AI’s October breach reached further than the company first said. In an updated security bulletin published November 9, the AI infrastructure provider disclosed that attackers accessed account and billing information and, for a limited set of customers, secrets, datasets and incomplete model weights — reached through a second intrusion that came in through a third-party cloud provider’s compromised machines. Why it matters: Fireworks runs inference and fine-tuning for more than 10,000 customers, so the incident is a live test of how much trust AI platforms can hold when the data at risk is the customer’s own models and training data.
November 10, 2026 — Tested Intelligence News Desk
What happened
Fireworks first identified unauthorized use of internal credentials on October 6, 2026, and said at the time that attackers had accessed environment variables — secrets used in evaluation jobs — in a limited number of customer accounts. Its October 9 bulletin said it had not detected access to customer models or datasets. The November 9 update revises that picture. A third-party cloud provider hosting Fireworks research-and-development machines had its own security incident on October 23; on October 24, the intruder used that opening to reach Fireworks development machines and run an unauthorized workload, which led to additional customer data impact. Fireworks says it detected the activity the same day and has not detected further successful unauthorized access on its customer platform since October 25.
What was accessed
According to the updated bulletin, an affected internal application exposed resource metadata (identifiers, display names, descriptions and creation times) and billing information covering billing and shipping addresses, invoice and payment history, account balances and credit usage. For a limited set of accounts, the exposure also included secrets, datasets and a subset of incomplete model weights. Payment card numbers were not affected — Fireworks says it does not store them. The company says it has detected no impact to Inference, its Training SDK or Nexus, all zero-data-retention by default, while stressing that the investigation is ongoing and may produce additional findings. Fireworks attributes the activity to a financially motivated cybercriminal group practicing “LLMjacking” — stealing access to large language models and reselling it through illicit gateways — and has notified law enforcement and brought in Palo Alto Networks Unit 42 for forensics. Self-serve dataset uploads and downloads used by Batch Inference and dataset-based training are disabled while the investigation continues.
The fallout
Some customers are not waiting for the final report. Forbes reported that two customers had already substantially moved their business off Fireworks’ systems; one described a series of “very bad hacks” and criticized the company’s communication, while two other customers told Forbes they were unaware of any hacks. Bloomberg, which characterized the November 9 notification as Fireworks’ second known hack in a matter of weeks, reported the company has been informing large customers, including legal AI firm Harvey, over the past week. Fireworks says it serves more than 10,000 customers; Forbes puts its enterprise customer base at roughly 10,000, including Uber, Shopify and Cursor.
Why it matters
The weak point here was not the production inference service — it was development machines hosted by someone else, reached weeks after the first incident was supposedly contained. For any team storing API keys, datasets or fine-tuned weights on an AI platform, the actionable lessons are the ones Fireworks itself is now pushing to notified customers: rotate the underlying third-party credentials (deleting a stored secret does not revoke it), audit for unrecognized keys, users and training jobs, and treat vendor dev environments as part of your own attack surface. We will update this story if Fireworks publishes further findings.
Frequently asked questions
Were customer prompts or inference traffic exposed?
Fireworks says it has detected no impact to Inference, the Training SDK or Nexus, which are zero-data-retention by default. That finding is based on its investigation to date, which is ongoing.
Were payment card numbers taken?
No. Fireworks says it does not store payment card numbers and they were not impacted. Billing addresses, invoice and payment history, balances and credit usage were among the data the affected application could expose.
How do I know if my Fireworks account was affected?
Fireworks is notifying customers whose data was impacted with account-specific details and recommended actions. Its earlier guidance told notified customers to rotate identified third-party credentials with the issuing providers and check for unrecognized keys, users, evaluators, training jobs and datasets.
Sources: Fireworks AI security bulletin (November 9 update, via Unite.AI), Forbes, Bloomberg.