Fireworks AI widened its account of the October security incident on November 9, 2026: attackers accessed customer data, including account and billing information, and, for a limited group of accounts, secrets, datasets, and incomplete model weights. It is the company's second disclosure about the case in a matter of weeks.
According to the update to the company's security bulletin, the affected internal application exposed resource metadata, billing and shipping addresses, invoice and payment history, account balances, and credit usage. Fireworks says it does not store payment card numbers, which were not affected.
The incident timeline
The timeline began on October 6, when the company detected unauthorized use of internal credentials. Customer notifications began on October 7, the first bulletin was published on October 9, and employee API keys were rotated. On October 10, additional keys were revoked and service-account tokens were rotated.
The second intrusion came from outside: on October 23, a third-party cloud provider hosting Fireworks research and development machines suffered a security incident. The next day, the intruder used that access to reach the company's development machines and run an unauthorized workload, widening the impact on customer data. The activity was detected the same day and, according to the company, there has been no further successful access to the customer platform since October 25.
The company's response
Fireworks notified law enforcement, engaged Palo Alto Networks' Unit 42 for forensic analysis, and disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training while the investigation continues. The company says it has detected no impact on Inference, Training SDK, and Nexus, services that by default retain no data — a conclusion limited to the investigation's current state.
The motive: LLMJacking
According to the company, the evidence links the attack to a financially motivated criminal group seeking to sell unauthorized access to language models through illicit routing gateways, a practice known as "LLMJacking". On November 2, the Google Threat Intelligence Group and Mandiant published a post about the growth of this practice. Bloomberg described the disclosure as the company's second known breach in weeks.
Fireworks says it serves more than 10,000 customers and was valued at $17.5 billion in July. Two customers told Forbes they had already moved much of their work off the platform, according to coverage of the case.
Image credit: Fireworks AI logo, via AMD's partners page.
Read also:Ex-CFO da Meta, Dave Wehner deixa a empresa para ser CFO da Fireworks AI
Sources: Unite.AI; Dealroom; Superpower Daily
Transparency: this article was produced with the assistance of artificial intelligence, based on cross-checking public posts and internet sources, verified against the original announcements. Please consult the original sources to confirm the details.
Muse
