Fireworks AI Breach Widens From API Keys to Customer Datasets and Model Weights

Fireworks AI, a company that hosts and serves AI models for other businesses, said on Monday that a security incident it first reported in October reached further than it had told customers. The update is reported by The Hacker News. Account and billing information, secrets, datasets and incomplete models belonging to a limited set of accounts were affected.

That is a change from the account the company gave a month earlier. Fireworks’ security bulletin, in the version we could read, says that on 6 October it found unauthorised use of internal credentials. Attackers took environment variables, including API keys and tokens stored as secrets, from certain customer accounts. It also says the company had found no evidence of access to customer models, datasets, training data, inference traffic or personal information.

What changed

The Hacker News reports that Fireworks now says attackers reached its development environment through an unnamed third-party cloud provider that hosted its research and development machines. On 23 October the attackers used that route. On 24 October they reached Fireworks development machines and ran an unauthorised workload, which the company says led to additional customer data impact. As of 25 October, it had not detected further successful access to the platform customers use.

The company lists what was exposed. It includes resource identifiers, names, descriptions and creation times. It also covers billing and shipping addresses, invoice and payment history, account balance and credit usage. A subset of incomplete model weights and datasets for certain customers was also reached. Fireworks says it does not store payment card numbers, so they were not affected. It says it is alerting customers whose data was reached.

The earlier bulletin stresses that Fireworks does not store prompts or outputs by default. Neither the bulletin nor the report says how many customers were affected, beyond “limited,” or how many accounts had datasets or weights taken.

Notion, a customer, says the incident touched fewer than 1% of its workspaces, according to The Hacker News. It first judged that attackers had reached only synthetic testing data for its AI features. It now says the data also included transcripts of Notion AI chats used for its Insights feature. For most affected workspaces, the chats were “unattributable,” meaning they were not labelled with the writer or workspace and held no tool-call results.

Notion has switched off Insights while it investigates and no longer serves open-weight models through Fireworks. It advises affected customers to rotate any passwords, API keys or credentials that were pasted into the workspace during the attack window.

Why attackers wanted the keys

Fireworks says the evidence points to a financially motivated cybercriminal group that wanted to sell tokens from unauthorised access to large language models to illicit routing gateways. The Hacker News describes this as LLMjacking, in which stolen credentials are used to run someone else’s AI models while the legitimate owner pays the bill. It adds that Google warned last week of a rise in attacks on AI infrastructure for this purpose in North America, South America and Asia Pacific.

The company says it has revoked credentials, rotated service-account tokens and API keys, isolated affected systems, tightened access controls and improved logging. Customers whose keys were revoked must create new ones, and the bulletin warns that applications using the old keys will fail until they are updated.

Customers face a second job: third-party credentials stored as secrets must be rotated with the companies that issued them, because deleting a stored secret does not cancel the underlying key. What would change the outcome for customers is early, specific notice of what was taken, and so far Fireworks has said only that affected customers are being told.