Fireworks AI Breach: A Hacked Cloud Provider Let Attackers Reach Customer Billing Data, Datasets and Model Weights, and What to Do Now

Fireworks AI, a platform businesses use to run and fine-tune AI models, says attackers got into its development machines through a hacked third-party cloud provider. They reached customer billing details and account metadata, and for some customers, datasets and unfinished model weights. If your company hands an AI vendor its data or API keys, this shows how a breach at a supplier you have never heard of can still reach your information.

Fireworks published the details in a bulletin update dated Monday, November 9, 2026. It follows an earlier incident the company disclosed on October 9, in which attackers used internal Fireworks credentials to read secrets stored in some customer accounts.

What happened at Fireworks AI

There are two parts to this story, and the second part is the new one.

The first incident (early October). Fireworks says it found unauthorized use of internal Fireworks credentials on Tuesday, October 6. An outside party accessed environment variables used in evaluation jobs in a limited number of customer accounts, and the company said API keys and secrets stored there were likely captured. At that point, Fireworks said it had found no evidence of access to customer models, datasets, training data, personal information or inference traffic.

The second incident (late October). The November 9 update says that on Friday, October 23, a third-party cloud provider that hosted Fireworks research and development machines had its own security incident. On Saturday, October 24, the unauthorized party used it to reach Fireworks development machines and ran an unauthorized workload that caused additional customer data impact. Fireworks says it detected the activity the same day. It also says that as of Sunday, October 25 it had not detected any further successful unauthorized access to the platform customers use.

Fireworks links the activity to a financially motivated criminal group that sells access to large language models, obtained without permission, through illicit routing gateways. The industry name for this is "LLMjacking": stealing someone else's AI access and reselling it, while the victim pays the bill.

Fireworks AI breach timeline

What data was accessed in the Fireworks AI breach

According to the November 9 update, the attackers accessed:

• Resource metadata: resource identifiers, display names, descriptions, creation times and similar details.
• Billing information: billing and shipping addresses, invoice and payment history, account balance and credit usage.
• Model weights and datasets: for certain customers, a subset of incomplete model weights and datasets.
• Stored secrets: the evaluation job environment variables from the first incident, for a limited set of accounts.

Fireworks says it does not store payment card numbers, so those were not affected. It also reports no impact to its Inference, Training SDK or Nexus products, which it says are zero data retention by default, meaning prompts and outputs are not kept. That finding is based on the investigation so far.

What is confirmed and what is not

Confirmed by Fireworks: the two intrusions, the dates above, the categories of data, and its response. It says it revoked and replaced credentials and service accounts, removed unnecessary elevated privileges, restricted unauthorized network paths, isolated affected systems, tightened access to data storage and analytics systems, and added logging and monitoring. Palo Alto Networks' Unit 42 team is doing the forensic analysis, and law enforcement has been notified. Self-serve dataset uploads and downloads for Batch Inference and dataset-based training are switched off while the investigation continues.

Not known: Fireworks has not named the cloud provider or said how that provider was breached. It has not given a number of affected customers beyond "limited." It has not said whether the stolen datasets or model weights have shown up anywhere. The bulletin status is "Active monitoring" and the investigation is ongoing, so the picture may change again.

Worth noting: the first bulletin said there was no evidence that customer datasets or models were reached. The update now says some were. Breach investigations often widen like this, which is a good reason not to treat any vendor's first statement as the final word.

Why a cloud provider breach reached Fireworks customers

Most businesses check the vendor they sign with. Very few ask who that vendor relies on. Here, customers trusted Fireworks with their data, Fireworks trusted a cloud provider to host development machines, and that provider's incident became the attacker's way in. Security teams call this third-party, or fourth-party, risk.

Two details matter for any company network or web platform:

1. Development machines had a path to customer data. The attacker reached R&D machines, and from there customer data was affected. Development and test environments are often less locked down than production, yet they regularly hold credentials or copies of real data.
2. Stored secrets are a target. The first incident was about API keys and tokens kept as environment variables. The group behind it profits from stolen AI access, so any key that can spend money on AI services is worth stealing.

If your business fine-tunes models on customer records, sales data or support tickets, those datasets are still your business data, even when they sit inside an AI platform's dashboard.

What to do this week if you use Fireworks AI

Fireworks says it is notifying the customers whose data was affected directly, with impact details and recommended response actions. Follow that notice if you get one. Its only public instruction for questions is to reply to the incident email or write to security-notice@fireworks.ai. Alongside that, these are sensible steps from us:

• Search your inbox, and your billing contact's inbox, for an incident notice from Fireworks.
• List every API key, token and third-party credential your team has ever stored in Fireworks.
• Revoke and reissue those credentials with the service that issued each one, then update your applications. Removing a value from a dashboard does not cancel the key with its issuer.
• Review usage and billing on those services for activity you do not recognize, including unexpected AI spending.
• Note which datasets and fine-tuned models you uploaded, and whether any hold customer or employee personal data. Talk to your legal adviser about whether that creates duties of your own.
• Ask your Fireworks contact whether your account is in the affected set, and which data categories apply to you.

What to do this week if you use any AI vendor

Fireworks AI breach questions people are asking

Was my Fireworks AI account affected?

Fireworks says it is notifying affected customers directly. If you have not heard from them and want to be sure, write to security-notice@fireworks.ai.

Were credit card numbers stolen in the Fireworks breach?

No, according to Fireworks. It says it does not store payment card numbers. Billing and shipping addresses, invoice and payment history, account balance and credit usage were accessed.

Which cloud provider was hacked?

Fireworks has not named it. It describes it only as a third-party cloud provider that hosted its R&D machines.

Were prompts and outputs exposed?

Fireworks reports no impact to Inference, Training SDK or Nexus, which it says are zero data retention by default. That is based on its investigation so far.

What is LLMjacking?

It means using stolen credentials to run AI models on someone else's account and selling that access to others. The account owner pays for the usage.

Is it safe to keep using Fireworks AI?

That is a business decision. Fireworks says it has replaced credentials, isolated affected systems and tightened access, and its investigation is still open. Rotating your own keys and limiting what data you upload lowers your exposure on any platform.

The bigger lesson

Your data travels further than your contract. Every AI tool, hosting company and SaaS app you use has suppliers of its own, and a breach two steps away can still land on your desk. Keep a list of what you have shared, keep keys narrow and easy to rotate, and treat a vendor's first incident report as a starting point, not a conclusion.

For help mapping your vendors, locking down keys and checking your own development environments, see security hardening or request a quote.

Get security alerts like this by email, with our free checklist, at security alerts.

Sources: Fireworks AI: October 2026 security incident update; Fireworks AI: October 2026 security incident.