Fireworks AI has admitted its October security breach reached far deeper than it first disclosed, exposing customer billing records, datasets and unfinished model weights. The AI infrastructure provider said on Monday that a second intrusion, through a third-party cloud provider, opened its development machines in late October and widened the damage beyond the stolen credentials it reported at the time. The update replaces a contained-incident story with a much wider one.
What Fireworks found
The update, published on 9 November, revises the bulletin Fireworks issued on 9 October, when it said an intruder had misused internal credentials and read environment variables in a limited number of customer accounts. At that stage the company said it had found no evidence that anyone had reached customer models, datasets, training data, personal information or inference traffic.
A month of investigation changed that picture. Fireworks now says the affected internal application exposed resource metadata, billing and shipping addresses, invoice and payment history, account balances and credit usage — and, for a limited set of accounts, secrets, datasets and a subset of incomplete model weights. Payment card numbers were not affected, because it does not store them.
A second way in
The damage came through a second route. A third-party cloud provider hosting Fireworks research machines suffered a security incident on 23 October, and the next day the intruder used that opening to reach Fireworks development machines and run an unauthorized workload. Fireworks says it detected the activity that day. Bloomberg called the update the company’s second known hack in weeks.
As of 25 October, the company says, it has found no further evidence of unauthorized access on the platform customers use. It has also found no detected impact on its Inference, Training SDK or Nexus services, which keep no customer data by default. Those findings rest on the investigation so far, and the inquiry is ongoing and may reveal more.
The LLMJacking connection
Fireworks links the attack to a financially motivated criminal group that steals access to large language models and resells it through illicit routing gateways, a practice known as LLMJacking. Google’s Threat Intelligence Group and Mandiant described the rise of the same technique in a blog post on 2 November, a week before Fireworks published its expanded disclosure.
The incident fits a wider pattern. Research from Wiz counted at least nine AI developer platforms that disclosed security incidents in October, with Fireworks among them, and most of the cases involved attackers hunting for stored credentials that grant access to AI models. Fireworks was one of the first names on that list, after its 6 October discovery.
What Fireworks has done
Fireworks says it notified law enforcement and brought in Palo Alto Networks Unit 42 for forensic analysis. It has revoked and replaced credentials and service accounts, removed unnecessary elevated privileges, restricted network pathways, isolated affected systems and tightened access to storage and analytics. It has disabled dataset uploads and downloads for Batch Inference and dataset-based training while the investigation continues.
Why It Matters
The disclosure changes the stakes for Fireworks customers. Stolen secrets can be rotated, but datasets and model weights are the raw material of a customer’s business, and Fireworks serves more than 10,000 customers, including Notion and Cursor. For companies running their models on someone else’s infrastructure, the incident is a reminder that the platform’s security is part of their own.
It also exposes a gap in how the industry talks about these breaches. The first bulletin, read alone, suggested a narrow credential problem; the second shows the same intruders reaching the data that makes an AI company valuable. Customers learned the fuller picture a month after the first signs, and only because Fireworks kept digging.
Our Read
The most telling detail is the route, not the loot. The second intrusion did not come through Fireworks itself but through a cloud provider hosting its research machines — a supply-chain failure that no amount of credential rotation inside Fireworks would have stopped. That is the uncomfortable part: the company’s perimeter held, and the damage still arrived through a vendor.
Fireworks handled the disclosure better than many of its peers: it updated its bulletin, named what was taken, and said plainly what it has not found. But the month-long gap between the first bulletin and the fuller picture will linger, and customers who trusted the platform with training data will now ask harder questions about where that data lives.
The disabled dataset uploads are the honest signal: the company is still not sure the hole is closed. Until Fireworks can say what the intruders did with the weights and datasets they reached, its customers are left to assume the worst and rotate everything — a costly answer, but the only safe one.
Background
Fireworks runs inference and fine-tuning infrastructure for more than 10,000 customers and was valued at 17.5 billion dollars in July. October was a bad month across the industry for the same kind of incident: Wiz counted at least nine AI developer platforms disclosing breaches, most involving stored credentials that unlock model access.
Source: Fireworks security bulletin · Bloomberg report
0 Comments