Fireworks AI Breach: A Cloud Provider Incident Reached Billing Records, Datasets and Model Weights, and What Customers Should Do This Week

Fireworks AI is a platform companies use to run and fine-tune AI models. On November 9, 2026 it said its October security incident was bigger than first reported: an attacker got in through a third-party cloud provider that hosted its research machines and reached customer billing details, account metadata and, for some customers, datasets and incomplete model weights. If your business builds on Fireworks or any other hosted AI service, your data is only as safe as the suppliers your supplier uses.

This post covers what Fireworks has confirmed in its own bulletins, what it has not said, and what to do this week.

What happened in the Fireworks AI breach

Fireworks has published two bulletins. The first, on October 9, described stolen internal credentials. The update, published one month later on November 9, added a second way in, through a cloud provider, and a much longer list of affected data.

What Fireworks has confirmed, and what it has not

Confirmed by Fireworks

The October bulletin said an attacker reached environment variables used in evaluation jobs in a limited number of customer accounts. Those variables can hold API keys and tokens stored as secrets. At that point Fireworks said it had found no access to customer models, datasets, training data or personal information.

The November update changes that picture. It lists these categories of affected data:

• Secrets, such as those used in evaluation jobs, for a limited set of accounts.
• Resource metadata: identifiers, display names, descriptions and creation times.
• Billing and account information: billing and shipping addresses, invoice and payment history, account balance and credit usage.
• Model weights and datasets: for certain customers, a subset of incomplete model weights and datasets was accessed.

Fireworks says it detected no impact on its Inference, Training SDK or Nexus products, which do not retain data by default. It also says payment card numbers were not affected, because it does not store them.

What Fireworks claims but has not shown publicly

Fireworks says the evidence links the activity to a financially motivated criminal group that sells access to AI models it has taken over without permission, a practice called LLMjacking. That is the company's own assessment. It has not published the technical evidence, and the investigation is ongoing.

What is not known

• Which cloud provider was breached. Fireworks does not name it.
• How many customers were affected. Neither bulletin gives a number.
• Whether data was copied or only viewed. The bulletin says "accessed", not "stolen".
• How the provider was breached, or which weaknesses were used to reach the development machines.

Fireworks says further findings may follow, so check the bulletin again before you close this out.

What is LLMjacking?

LLMjacking is when criminals take over someone else's access to an AI model and sell it on. They might use stolen API keys or cloud accounts to do it. The victim pays for the computing while someone else uses it, or resells it. Fireworks says the group behind this incident sells that stolen access through illicit routing gateways, which are services that pass paid AI requests through accounts the seller does not own.

This matters for any business holding AI keys: an exposed key can mean surprise bills, as well as a data risk.

What Fireworks AI customers should do this week

Fireworks says it is notifying affected customers directly. Its October bulletin gave these steps, and they still apply.

If you uploaded datasets or fine-tuned models on Fireworks, decide now what it would mean if that data were exposed. Customer records, internal documents or code in training data may need their own breach review.

Why a vendor's vendor matters for your business

Nothing in this incident required a mistake by Fireworks customers. The second route in went through a cloud provider that hosted Fireworks' own development machines. Customers had no contract with that provider and probably did not know it existed.

That is the point for any company that relies on SaaS tools, AI platforms or hosted apps. When you sign up with a vendor, you take on the risks of every service that vendor uses. A security certificate does not remove that risk. Fireworks lists SOC 2 Type 2 and several ISO certifications, and a supplier was still breached.

Questions worth asking your AI and SaaS vendors:

1. Which outside providers host or can reach our data, including in development and test environments?
2. Is our data ever copied out of production into research or development systems?
3. How quickly will you tell us if one of your providers is breached?
4. Can we turn off data retention, and is it off by default?

On your own side, limit what you hand over. Give AI platforms keys with the narrowest permissions and spending limits you can. Don't upload more data than the job needs, and keep a list of which secrets live with which vendor so you can rotate them in an afternoon.

Fireworks AI breach questions people are asking

Was my payment card stolen in the Fireworks AI breach?

Fireworks says no. It does not store payment card numbers. Billing and shipping addresses, invoices, payment history and balances were affected.

Which cloud provider was hacked?

Fireworks has not named it. It says only that a third-party cloud provider hosting its research and development machines had a security incident on October 23, 2026.

Were my AI models or prompts exposed?

Fireworks says a subset of incomplete model weights and datasets was accessed for certain customers. It found no impact on Inference, Training SDK or Nexus, and says it does not store prompts or outputs by default.

Do I need to act if I did not get a notice?

The October bulletin said customers without a notice needed no incident-specific action. It is still sensible to review your account and rotate secrets stored on the platform, because the investigation is ongoing.

Is the Fireworks AI incident over?

Not yet. The bulletin status is "active monitoring", Palo Alto Networks Unit 42 is helping with the forensic work, and Fireworks says more findings may follow.

The bigger lesson

Every hosted service you use depends on other services you cannot see. You can't audit them all, but you can control how much data and access each vendor holds, and how fast you can rotate it when one of them has a bad day.

To review which vendors hold your keys and data, see our security hardening service or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: Fireworks: October 2026 security incident; Fireworks: October 2026 security incident update.