Fireworks AI Says Attackers Reached Datasets and Model Weights

Fireworks AI disclosed on November 9, 2026 that attackers who breached its systems accessed account and billing information and, for a limited group of customers, secrets, datasets and incomplete model weights. The AI infrastructure provider had originally described the October incident as unauthorized use of internal credentials, a framing the new disclosure materially widens.

The stakes are significant for the AI infrastructure market. Companies like Fireworks host the raw assets of AI development — training datasets, model weights (the numerical parameters a trained model consists of), and API credentials — and a breach there exposes both customer IP and the billing relationships around it. The incident also demonstrates how development environments and third-party cloud infrastructure can become the weak link even when production systems hold.

What did the attackers actually access?

According to the November 9, 2026 disclosure, the compromised internal application exposed resource metadata including identifiers, display names, descriptions and creation times. Billing information covered billing and shipping addresses, invoice and payment history, account balances and credit usage.

One category stayed intact: payment card numbers. Fireworks states it does not store them, so they were not affected.

The company is providing account-specific details and recommended responses to customers whose data was impacted. It cautioned that the ongoing investigation may produce additional findings.

How did the intrusion unfold?

The incident began weeks before the expanded disclosure. On October 6, 2026, Fireworks identified unauthorized use of internal credentials and began containment. An unauthorized party had accessed environment variables used in evaluation jobs in a limited number of customer accounts. At that stage, Fireworks had not detected unauthorized access to customer models, datasets, training data, personal information or inference traffic within its security perimeter or control.

The company notified customers on October 7, 2026. It rotated employee API keys on October 9, 2026 — the same day it published its initial bulletin — and revoked additional user keys and rotated service-account tokens on October 10, 2026.

Then the attackers found a second way in. On October 23, 2026, a third-party cloud provider hosting Fireworks research-and-development machines experienced its own security incident. On October 24, 2026, the unauthorized party used that incident as a route into Fireworks development machines and ran an unauthorized workload. That workload produced the additional customer-data impact disclosed on November 9.

Fireworks detected the activity on October 24, took remediation measures and closed known critical vulnerabilities. As of October 25, 2026, the company stated it had not detected further successful unauthorized access by the actor on the platform customers use.

What is restricted while the investigation runs?

Fireworks notified law enforcement and engaged Palo Alto Networks Unit 42, the company's forensic investigation arm, for analysis. Its response has included:

• Revoking and replacing credentials and service accounts
• Removing unnecessary elevated privileges
• Restricting unauthorized network pathways
• Isolating affected systems
• Tightening access to storage and analytics systems
• Enhancing logging and monitoring

Customer-facing operations are also constrained. Self-serve dataset uploads and downloads — used by Batch Inference and dataset-based training — are disabled while the investigation continues.

Training capabilities remain available under tightened conditions. The Training SDK operates with zero data retention, meaning no training data is stored at rest. Fireworks Lab-based training runs in an isolated environment with additional network and storage protection.

Fireworks reports no detected impact to Inference, Training SDK or Nexus, all of which are zero data retention by default. The company qualified that finding as limited to the investigation to date. Its data-security documentation states that open-model inference prompts and generations are not logged or stored without explicit user opt-in, and that Nexus does not store prompts, responses, code, tool calls or traces. Nexus retains service metadata needed to operate the service and de-identifies it after 30 days.

What should affected customers do?

Earlier guidance from Fireworks told notified customers to:

• Replace revoked Fireworks API keys
• Rotate identified third-party credentials with their issuing providers
• Review associated logs and data
• Check for unrecognized keys, users, evaluators, training jobs and datasets

The company flagged one subtle trap: removing a stored secret alone does not invalidate the underlying third-party credential.

Who is behind it, and what is LLMJacking?

Fireworks said its evidence links the activity to a financially motivated cybercriminal group aiming to sell unauthorized LLM access through illicit routing gateways, an activity known as LLMJacking. The company cited November 2, 2026 research from Google Threat Intelligence Group and Mandiant describing LLM Mixers — illicit gateways that proxy, aggregate and resell unauthorized model access to underground subscribers. Some operations divide the initial compromise from downstream monetization.

The economics are substantial. Across Mandiant's separate investigations, observed fraudulent resource-consumption charges exceeded $100,000 in a single day in individual incidents and reached $1 million cumulatively at some organizations before access was revoked. Those figures describe the broader investigations, not Fireworks' losses.

Exposed or stolen cloud identity tokens were the dominant initial-access vector across those cases — consistent with the credential-based entry Fireworks described in its own incident.

The researchers recommend centralized secrets management, least-privilege access, routine configuration audits, spending controls and monitoring for anomalous, low-volume requests that can validate stolen credentials without triggering volume-based alarms. Fireworks' credential replacement, privilege reduction and expanded monitoring align with several of those defensive priorities, while its update also exposes the risks surrounding development machines and third-party infrastructure.

What happens next?

For Fireworks customers, the response now extends beyond replacing keys to assessing billing information and, for the limited group, datasets and unfinished model assets. With dataset transfers still disabled, the investigation ongoing, and the company warning that further findings may emerge, the incident ties a development-environment compromise to both exposure of AI assets and disruption of the workflows used to build them.