- Fireworks AI says its first bulletin covered only stored secrets. It has since found account and billing impact, and for a limited set of accounts, datasets and incomplete models.
- Fireworks says new access came on October 23-24, after the first bulletin. The sources do not say whether it was part of the original intrusion.
- Customers should list which keys and data sit with AI vendors, and ask how each vendor will report problems at its own suppliers.
An incident notice is a snapshot, and this one moved
An incident notice shows what a company had confirmed on the day it wrote it. Later findings can change the picture. The Fireworks AI case shows how far.
Fireworks AI provides infrastructure that companies use to run and tune AI models. Its first bulletin came out on October 9. At that point, the company says, the only confirmed exposure was secrets it stored, such as those used in evaluation jobs. A secret is a credential, like an API key, that lets software act for a customer.
Since then, Fireworks says it found more. Account and billing information was affected. For a limited set of accounts, so were secrets, datasets and incomplete models.
What the dates do and do not show
The Hacker News reports that Fireworks detected the first activity on October 6. The newer impact traces to later dates.
Fireworks says a third-party cloud provider that hosted its research machines had a security incident on October 23. On October 24, an unauthorized party used that access to reach Fireworks development machines. It then ran a workload that Fireworks says caused additional customer data impact.
Both dates fall after the first bulletin. The sources do not say whether the October 24 activity was part of the original intrusion or a later step. So this is not proof that the first notice understated what was already stolen.
The safer reading is that the scope kept changing. Fireworks itself calls its investigation ongoing. It says it caught the October 24 activity the same day. As of October 25, it had seen no further successful access to the platform customers use.
What was exposed, and what was not
Fireworks lists three kinds of information in the affected internal application. The first is resource metadata, such as identifiers, display names and creation times. The second is billing data: addresses, invoice and payment history, account balance and credit usage. The third is a subset of incomplete model weights and datasets, for certain customers.
Fireworks says it does not store payment card numbers, so none were affected. It also reports no impact on three products: Inference, Training SDK and Nexus. By default, these keep no customer data. Fireworks bases this on its investigation so far.
The company says it is notifying affected customers. It has also paused self-serve dataset uploads and downloads for Batch Inference and dataset-based training.
Why stolen AI access finds buyers
Fireworks says the evidence points to a financially motivated criminal group. Its goal, the company says, was to resell access to large language models through illicit routing gateways. The practice is called LLMjacking.
The Hacker News describes how it works. Criminals take over a victim's model access with stolen credentials and sell it on. The rightful owner pays the bill.
Fireworks points to a November 2 blog post on the topic from Google Threat Intelligence Group and Mandiant. The Hacker News adds that Google warned of more attacks on AI systems for this purpose. It named North America, South America and Asia Pacific, and four sectors: financial services, retail, technology and transportation.
This is the publication's reading: a store of API keys is attractive in its own right. A stolen key is not only a way to read data. It is something a criminal can sell.
The risk can sit with a supplier you cannot see
Fireworks did not name the cloud provider. Customers therefore cannot tell which supplier was involved. In our view, that is the lesson: your AI exposure includes your vendor's vendors.
Notion shows how this reaches a customer. The Hacker News reports that Notion said the incident affected "fewer than 1% of Notion workspaces." Notion first judged that only synthetic test data was involved. It later found potential customer data. That included Notion AI chat transcripts used for its Insights feature.
Notion said most affected workspaces had unattributable chats. In its words, that means they carried no author label. This limits the harm. It does not remove it. The sources do not say what the chats contained.
Notion is the clearest case of an assessment that grew, from test data to customer data. It is one incident seen through two companies. It is not a trend.
Questions to put to your team
Start with inventory. Which AI vendors hold your API keys, datasets or model files? For each, does the service keep data, or does it keep none by default? Fireworks drew exactly that line.
Next, check your credentials. Can your team revoke and replace every key given to an AI provider within a day? Do your cloud bills show model usage nobody planned? That is how LLMjacking reaches the victim.
Then look at contracts. Must your vendors tell you about incidents at their own suppliers, and how soon? Also check whether any of your workflows relied on the Fireworks dataset uploads and downloads now paused.
A breach notice tells you what a vendor has found so far. Plan for what it may still find.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Fireworks AI.
