Fireworks AI has disclosed a wider impact from its October 2026 security incidents, revealing that attackers accessed customer account and billing information and, in a limited number of cases, stored secrets, datasets, and incomplete AI model weights. The updated disclosure, published on November 9, significantly expands what the company initially reported in October.
The AI infrastructure provider said its investigation identified unauthorized activity involving internal credentials and a separate security incident at a third-party cloud provider hosting its research and development machines. Fireworks detected the additional activity on October 24 and said it had not detected further successful unauthorized access to the customer platform after October 25.
The incident highlights a growing security concern for businesses using third-party AI infrastructure: protecting an AI application is not enough if the credentials, development environments, datasets, and cloud services behind it are exposed.
Here is what happened, what information may have been accessed, how the incident relates to LLMjacking, and what companies using AI infrastructure should do to reduce their risk.
What Happened in the Fireworks AI Data Breach?
Fireworks AI first disclosed a security incident on October 9, 2026. The company said it had identified unauthorized use of internal Fireworks credentials on October 6. An unauthorized third party accessed environment variables used in evaluation jobs in a limited number of customer accounts.
At that time, Fireworks said it had not detected evidence of unauthorized access to customer models, datasets, training data, personal information, or inference traffic within the Fireworks security perimeter or control. It began containment and notified the customers it had identified as affected.
However, the investigation later uncovered additional access. In its November 9 update, Fireworks said account and billing information had also been impacted. For a limited set of accounts, investigators identified access to secrets, datasets, and incomplete models.
The company also disclosed another intrusion route involving a third-party cloud provider that hosted its research and development machines. That provider experienced a security incident on October 23. On October 24, an unauthorized party used the access to reach Fireworks development machines and run an unauthorized workload that resulted in additional customer data impact.
Fireworks said it detected this activity on October 24 and took remediation measures. According to the company's update, it had not detected further evidence of successful unauthorized access to the customer platform after October 25.
Fireworks AI Breach Timeline
| Date | What happened |
|---|---|
| October 6, 2026 | Fireworks identified unauthorized use of internal credentials and began containment. |
| October 9, 2026 | The company published its first security bulletin, describing access to environment variables in a limited number of customer accounts. |
| October 10, 2026 | Fireworks updated its initial response details, including additional credential revocations and rotations. |
| October 23, 2026 | A third-party cloud provider hosting Fireworks R&D machines experienced a security incident. |
| October 24, 2026 | An unauthorized party used the third-party access to reach Fireworks development machines and run an unauthorized workload. |
| October 25, 2026 | Fireworks said it had not detected further successful unauthorized access to the customer platform after this date. |
| November 9, 2026 | Fireworks published an expanded update revealing additional impacts to account, billing, datasets, secrets, and incomplete models. |
The timeline shows why the updated disclosure matters: the initial October bulletin described a narrower set of known impacts, while the subsequent investigation identified additional data exposure and another route into development systems.
What Customer Data Was Accessed?
In its November 9 security bulletin, Fireworks identified several categories of information that the affected internal application could access.
1. Account and resource information
This included resource metadata such as Fireworks resource identifiers, display names, descriptions, and creation times. Although these details may not be equivalent to passwords or payment credentials, they can reveal information about how a customer organizes and uses its AI resources.
2. Billing and account information
The exposed billing information included:
- Billing and shipping addresses
- Invoice and payment history
- Account balances
- Credit usage
Fireworks stated that it does not store payment card numbers, so payment card numbers were not affected by this incident.
3. Stored secrets
Stored secrets can include credentials and tokens used by applications or evaluation jobs to access other services. Depending on the permissions attached to a credential, unauthorized access could allow an attacker to interact with connected systems or resources.
The first October disclosure specifically described environment variables containing API keys and tokens used in evaluation jobs. The November update expanded the known impact to secrets and other customer information.
4. Datasets and incomplete AI model weights
For a limited set of accounts, Fireworks said a subset of datasets and incomplete model weights was accessed. These resources can contain commercially sensitive information, proprietary training material, or valuable work in progress.
Model weights are the learned numerical parameters that determine how a trained AI model behaves. Access to model weights can create intellectual-property and confidentiality concerns, although the company described the affected models as incomplete and did not publish the amount or identity of the affected customer material.
Fireworks has not disclosed the exact number of affected customers or the total volume of datasets and model weights accessed. It said it is notifying customers whose data was impacted and providing account-specific details and recommended response actions.
What Was Not Reported as Affected?
It is important to distinguish confirmed findings from areas where Fireworks has not detected an impact. According to the company's November 9 update:
- Payment card numbers: Fireworks said it does not store card numbers, so they were not affected.
- Inference: The company reported no detected impact to its Inference service.
- Training SDK: Fireworks reported no detected impact to this service.
- Nexus: The company also reported no detected impact to Nexus.
Fireworks said Inference, Training SDK, and Nexus are zero data retention (ZDR) by default. Zero data retention means the service is designed not to retain customer prompts or outputs as stored data under its stated default configuration. It should not be interpreted as a guarantee that every system, credential, or development environment is immune to security incidents.
These findings reflect the company's investigation at the time of its update. Fireworks said the investigation is ongoing and may reveal additional information.
What Is LLMJacking and How Does It Work?
Fireworks said the evidence indicated links to a financially motivated cybercriminal group focused on selling unauthorized access to large language models through illicit routing gateways. This activity is known as LLMjacking.
LLMjacking Happens when attackers obtain unauthorized access to AI model resources, API credentials, cloud accounts, or computing capacity and use that access for their own purposes or resell it to others.
Google Threat Intelligence Group and Mandiant published research on November 2, 2026, describing how threat actors hijack enterprise access to large language models and monetize stolen resources.
The research describes a broader attack pattern involving stolen cloud identity tokens, service-account keys, GitHub personal access tokens, active session tokens, and exposed AI API keys. Attackers may use these credentials to access cloud infrastructure, create additional keys, provision computing resources, or route model Requests through unauthorized services.
How attackers can monetize stolen AI access
- Obtain access: Attackers steal or discover API keys, cloud credentials, service-account tokens, or other valid access credentials.
- Explore connected resources: They examine available permissions, cloud services, model endpoints, repositories, and stored secrets.
- Abuse AI resources: They use stolen access to send model requests, provision computing resources, or create additional credentials.
- Resell access: Unauthorized model access can be routed through illicit gateways that sell usage to other customers.
- Leave the legitimate account owner with the cost: The victim may face unexpected API usage, cloud charges, or resource consumption.
Google's research documented incidents in which fraudulent resource consumption generated charges exceeding $100,000 in a single day, with cumulative charges reaching $1 million at some organizations before access was revoked. These figures come from separate investigations described by Google and should not be interpreted as losses reported by Fireworks.
Why the Third-Party Cloud Provider Matters
One of the most important lessons from the Fireworks incident is the security risk created by third-party infrastructure. The company said a cloud provider hosting its research and development machines experienced a security incident before an unauthorized party used that access to reach Fireworks development systems.
This illustrates a supply-chain security problem. A business may secure its own applications and accounts, but it also depends on cloud providers, development environments, contractors, software tools, and other external services.
If one of those connected environments is compromised, attackers may try to use its access to reach other systems. This does not mean every third-party provider is unsafe. It means organizations need to understand what access their suppliers have, what data those suppliers handle, and how quickly compromised credentials can be revoked.
For AI businesses, this is particularly important because development and evaluation environments may handle API credentials, datasets, model artifacts, and access to expensive computing resources.
What Should Fireworks AI Customers Do Now?
Fireworks said it is directly notifying customers whose data was impacted and providing account-specific information and response recommendations. Customers who receive an incident notification should follow the exact instructions in that communication.
1. Identify and rotate affected Fireworks API keys
Review the Fireworks notification for API keys or secrets identified as affected. Revoke or replace the keys that the company identifies, then update applications and services that depend on them.
Do not assume that deleting a stored secret automatically invalidates the underlying credential. A credential must be revoked or rotated with the service that issued it.
2. Rotate affected third-party credentials
If the notification identifies credentials belonging to another provider, contact that provider and rotate or revoke those credentials there. Update applications and stored secrets that use the old values.
Prioritize credentials with broad permissions, access to production data, or the ability to create additional keys and service accounts.
3. Review API usage and billing activity
Examine usage reports, invoices, account balances, and credit consumption for activity you cannot explain. Look for unusual request volumes, unfamiliar model usage, unexpected resource creation, or sudden increases in cloud and inference costs.
Set usage alerts and spending limits where supported. These controls can help identify suspicious activity before it becomes expensive.
4. Check for unfamiliar resources and accounts
Fireworks advised affected customers to review API keys, users, evaluators, training jobs, and datasets. Investigate resources you do not recognize and report their names or identifiers to Fireworks through the company's official incident-response channel.
5. Review access logs and connected services
If an exposed credential could access another service, review the relevant provider's logs for unauthorized reads, downloads, changes, or account activity. Follow the issuing provider's security guidance if you identify suspicious access.
6. Assess exposed datasets and model artifacts
Determine whether any affected datasets or incomplete model weights contain proprietary training material, confidential business information, personal information, or customer records. Your response may need to include internal security, privacy, legal, and customer-notification teams depending on what the material contains and the applicable obligations.
7. Follow official Fireworks incident communications
Fireworks has asked affected customers to reply to their incident notification email or contact its security team. Use the contact details published in its official security bulletin rather than links or phone numbers from unsolicited messages.
How AI Companies Can Reduce LLMJacking Risks
The Fireworks incident and Google's LLMJacking research offer several practical lessons for organizations building applications with external AI infrastructure.
Use scoped, short-lived credentials
Give API keys and service accounts only the permissions required for their tasks. Avoid broad administrative credentials in development environments, evaluation jobs, and automated workflows. Where possible, use short-lived credentials that expire automatically.
Store secrets in a dedicated secrets manager
Avoid hardcoding API keys in source code, notebooks, configuration files, or public repositories. Use a managed secrets system with access policies, auditing, and controlled retrieval.
Separate development, evaluation, and production environments
Keep development and testing environments separate from production systems. Evaluation jobs should not automatically inherit unrestricted access to production datasets, model artifacts, or cloud credentials.
Monitor unusual AI usage and cloud spending
Monitor API request patterns, token consumption, model selection, resource creation, and billing activity. Sudden usage spikes, requests from unfamiliar locations, or unexpected service-account activity can indicate credential abuse.
Restrict public model endpoints
Do not expose inference endpoints or model-management interfaces to the public internet without appropriate authentication and access controls. Use network restrictions, rate limits, and monitoring to reduce unauthorized use.
Review third-party access
Maintain an inventory of external cloud providers, development tools, and service accounts that can reach sensitive systems. Regularly review their permissions, remove unnecessary access, and establish a process for investigating and revoking compromised credentials.
Prepare a credential-rotation and incident-response plan
Organizations should know how to revoke keys, replace service-account credentials, isolate affected environments, review logs, and identify data accessible through compromised tokens. A documented response plan reduces delays during a real incident.
What Fireworks AI Has Done in Response
Fireworks said it notified law enforcement and engaged Palo Alto Networks Unit 42 to help with forensic analysis. The company also described several security-hardening measures implemented during its response.
- Credential lockdown: Revoked and replaced credentials and service accounts, removed unnecessary elevated privileges, and tightened controls over the creation of unauthorized credentials.
- Network isolation: Restricted unauthorized network pathways and isolated affected systems to limit further activity and movement.
- Data protection: Reviewed and tightened access to data storage and analytics systems to prevent public or unauthorized access.
- Logging and monitoring: Secured and enhanced forensic and audit systems.
- Dataset controls: Disabled self-service dataset uploads and downloads used by Batch Inference and dataset-based training while the investigation continues.
Fireworks said Training SDK remains available with zero data retention, and Fireworks Lab-based training operates in an isolated environment with additional network and storage protections. The company said it would continue monitoring its systems around the clock and provide further updates as appropriate.
Frequently Asked Questions
Did Fireworks AI suffer a second cyberattack?
Fireworks initially reported unauthorized use of internal credentials detected on October 6. Its November 9 update also described a third-party cloud provider incident on October 23, followed by unauthorized access to Fireworks development machines on October 24. The company described the later activity as additional activity connected to its October security incident.
What data was exposed in the Fireworks AI breach?
Fireworks reported access to resource metadata and billing information, including billing and shipping addresses, invoice and payment history, account balances, and credit usage. For a limited set of accounts, secrets, datasets, and incomplete model weights were also accessed.
Were customer payment card numbers stolen?
Fireworks said it does not store payment card numbers, so card numbers were not affected by the incident.
Were AI prompts and outputs exposed?
Fireworks said it had not detected an impact to Inference, Training SDK, or Nexus, which are zero data retention by default. The company did report access to certain datasets, secrets, and incomplete models for a limited set of accounts. Its investigation remains ongoing.
What is LLMjacking?
LLMjacking is the unauthorized use of stolen or compromised access to large language models, API credentials, or cloud resources. Attackers may use the access themselves or resell it through illicit routing gateways, potentially leaving the legitimate account owner with unexpected usage charges.
How many Fireworks AI customers were affected?
Fireworks has not published a confirmed number of affected customers. It said it is directly notifying customers whose data was impacted and providing account-specific information.
What should affected Fireworks customers do first?
Follow the account-specific incident notification, revoke or rotate affected Fireworks API keys, rotate identified third-party credentials with their issuing providers, and review usage logs, billing activity, and unfamiliar resources.
Is Fireworks AI still investigating the incident?
Yes. Its November 9 security bulletin said the investigation with Palo Alto Networks Unit 42 was ongoing and that additional findings may emerge.
Official Sources and Further Reading
- Fireworks AI: Update on October 2026 Security Incident the November 9 update covering additional data exposure, the third-party cloud incident, and remediation measures.
- Fireworks AI: October 2026 Security Incident the original October disclosure and instructions for affected customers to rotate credentials and review activity.
- Google Threat Intelligence Group and Mandiant: The Rise of LLMJacking research into stolen cloud and AI credentials, illicit model access, attacker monetization, and defensive measures.
- Palo Alto Networks Unit 42 cybersecurity threat research and incident-response information.
Final Thoughts
The Fireworks AI incident shows how a security problem involving credentials and development infrastructure can extend beyond a single application. The company's updated investigation identified access to billing information and, for a limited number of customers, datasets, secrets, and incomplete AI model weights.
For businesses using AI infrastructure, the lesson is to treat API keys, cloud identities, datasets, model artifacts, and third-party development environments as critical security assets. Restrict access, monitor usage, rotate exposed credentials, and understand exactly what each service can reach.
Fireworks says it is continuing its investigation with Unit 42 and notifying affected customers. Until more findings are published, organizations should rely on the company's official security bulletins for incident-specific information rather than assume that every customer or every AI service was affected.
