Fireworks AI Breach: LLMjacking Attackers Reached Customer Secrets, Datasets and Model Weights, and What to Rotate This Week

Fireworks AI is a platform businesses use to run and fine-tune AI models, and it has widened its breach disclosure: attackers reached account and billing records for affected customers and, for a limited set of accounts, stored secrets, datasets and incomplete model weights. If your company stored API keys or other credentials with Fireworks, or trained a model there, check this week whether you received a notice and replace those credentials with the service that issued them.

What happened in the Fireworks AI breach

Fireworks published its first security bulletin on Friday, October 9, 2026. It said it had found the activity on October 6. An unauthorized third party had used internal Fireworks credentials to reach environment variables used in evaluation jobs in a limited number of customer accounts. Those environment variables included API keys and tokens that customers had stored as secrets, and Fireworks said they were likely captured in some affected accounts. At that point it reported no evidence that anyone had accessed customer models, datasets, training data, or prompts and outputs.

The update was last revised on Monday, November 9, 2026, and it changes that picture. Fireworks now says:

• Account and billing information was affected for all affected accounts. This includes resource metadata and billing details such as addresses, invoices, payment history, balances and credit usage. Fireworks did not store payment card numbers, so they were not affected.
• For a limited set of accounts, secrets, datasets and incomplete models were affected. For certain customers, attackers accessed a subset of incomplete model weights and datasets.
• A third-party cloud provider that hosted Fireworks research and development machines had its own security incident on October 23. On October 24, the unauthorized party used that incident to reach Fireworks development machines. It ran an unauthorized workload there that exposed more customer data. Fireworks says it detected this the same day.
• As of October 25, Fireworks says it had found no further evidence of successful unauthorized access to the platform customers use.

Fireworks says its inference service, Training SDK and Nexus keep no customer data by default (zero data retention), and it has detected no impact to them. Self-serve dataset uploads and downloads for Batch Inference and dataset-based training are turned off while the investigation continues. The bulletin's status reads "Active monitoring."

Who is behind it: what is claimed and what is confirmed

Confirmed by Fireworks: it notified law enforcement and hired Palo Alto Networks Unit 42 for the forensic investigation.

Claimed by Fireworks, not independently confirmed: the bulletin says the evidence "indicates links to a cybercriminal threat actor group." Fireworks describes this group as financially motivated. It says the group sells tokens from unauthorized access to large language models to illicit routing gateways, a practice called LLMjacking. Fireworks has not named the group, and no outside party has published its own attribution for this incident.

Fireworks points readers to a report on LLMjacking that Google Threat Intelligence Group and Mandiant published on November 2, 2026. That report does not mention Fireworks. It explains how this kind of crime works, but it is not evidence about this breach.

Not known yet:

• How the attackers first got the internal Fireworks credentials.
• How many customer accounts are affected.
• Whether stolen customer secrets have been used against other services.
• Whether any of the accessed model weights or datasets have been sold or published.

What is LLMjacking?

LLMjacking means stealing access to AI models and running them at the victim's expense. According to Google's report, Mandiant handled multiple LLMjacking incidents in 2026. The attackers used exposed or stolen cloud credentials, leaked AI API keys and hijacked session tokens. They then resold the access through what the report calls LLM mixers: routing gateways that pool stolen keys and sell cheap access to underground subscribers.

The victim pays the bill. Google reports fraudulent charges above $100,000 in a single day in individual incidents, and totals reaching $1 million at some organizations before the access was cut off. One routing service it tracked made more than 500,000 API calls in under eight hours, which left one victim with nearly $1 million in token costs.

That is why the detail about stored secrets matters. An attacker who collects AI API keys and cloud tokens from one platform can try them on every service those keys unlock.

Why the Fireworks AI breach matters for a business

Many companies now connect AI vendors to the rest of their systems. A fine-tuning job or evaluation pipeline often holds keys to cloud storage, a model provider, a database or a code repository. When the AI vendor is breached, those keys are exposed along with the vendor's own data.

Two points from Fireworks' own guidance are worth repeating. First, deleting a stored secret from the vendor does not cancel it: the key keeps working until the company that issued it revokes it. Second, check activity even if nothing looks wrong, because the attacker may have used the access quietly.

For companies that trained custom models, losing datasets or partial weights is a confidentiality problem, because training data can include customer records or internal business knowledge. Fireworks calls the accessed weights incomplete. What anyone could do with them is not known, and there is no public evidence so far that they have been used or sold.

What to do this week

Fireworks says customers who did not receive a notice do not currently need to take any action for this incident. Steps 6 and 7 come from Google's LLMjacking guidance and make sense for any company using AI APIs. That guidance also recommends managing secrets in one central place, rotating keys automatically, scanning code repositories for leaked secrets, and using phishing-resistant MFA on cloud and developer consoles.

If you run AI models on AWS, Azure or Google Cloud yourself, Google's report lists the audit logs to watch. It also notes that in Google Cloud, the Data Access audit logs for the AI platform service are off by default. If nobody at your company clearly owns those settings, our post on who is patching the software that runs your business covers that question.

Fireworks AI breach questions people are asking

Was Fireworks AI hacked?

Yes. Fireworks confirmed that someone used internal Fireworks credentials without authorization, which it found on October 6, 2026. A second intrusion came through a third-party cloud provider on October 24.

What data was stolen in the Fireworks AI breach?

Account and billing information for affected accounts. For a limited set of accounts, also stored secrets, datasets and incomplete model weights. Fireworks did not store payment card numbers, so they were not affected.

Were AI prompts and outputs exposed?

Fireworks says its inference service keeps no data by default, and it has detected no impact to inference, Training SDK or Nexus.

What is LLMjacking?

LLMjacking means stealing access to AI models, usually through stolen API keys or cloud credentials, and reselling it. The victim is left with the bill.

Who attacked Fireworks AI?

Fireworks says the evidence links the attack to a financially motivated cybercriminal group involved in LLMjacking. It has not named the group.

Do I need to do anything if I use Fireworks AI?

If you received a notice, follow it and replace the listed credentials with the services that issued them. If you did not, Fireworks says no action is needed for this incident, though spending caps and limited keys are still worth setting.

The bigger lesson

Every AI tool you connect holds keys to other parts of your business. When a vendor reports a breach, treat the secrets you stored there as exposed, replace them with the services that issued them, and limit each key to what it needs. The same care applies to apps built on AI, as we covered in AI can build your app. Who is going to keep it running?

Want your AI integrations and stored credentials reviewed? See security hardening or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: Fireworks AI: October 2026 security incident update; Fireworks AI: October 2026 security incident; Google Threat Intelligence Group and Mandiant: The Rise of LLMJacking.