Fireworks AI Breach: LLMJacking Attackers Took API Secrets, Billing Data and Some Model Weights, and What Customers Should Rotate This Week

Fireworks AI is a cloud platform where companies run and fine-tune open-source AI models. It now says an attacker who got into its systems in October took more than it first reported: account and billing records, stored secrets from some accounts, and for certain customers, datasets and incomplete model weights. If your company or your developers keep API keys or training data on Fireworks, look for a notice from the company and rotate those keys. Deleting a stored secret does not cancel the key behind it.

Fireworks links the attack to LLMJacking. That is the theft of access to AI models so criminals can resell it. This post covers what Fireworks has confirmed, what it has not said, and what to check this week.

What happened in the Fireworks AI breach

Fireworks has published two security bulletins. The first went up on Friday, October 9, 2026, and the update on Monday, November 9, 2026. Here is the timeline from both.

Fireworks says it has notified law enforcement and brought in Palo Alto Networks Unit 42 for forensic work and hardening.

What was stolen: confirmed and not known

Confirmed by Fireworks in the November 9 update:

• Resource metadata: resource IDs, display names, descriptions and creation times.
• Billing information: billing and shipping addresses, invoice and payment history, account balances and credit usage.
• Secrets: at first Fireworks said only secrets used in evaluation jobs were known to be affected. It now says secrets were affected for a limited set of accounts. The first bulletin said these environment variables included API keys and tokens stored as secrets.
• Model weights and datasets: for certain customers, attackers accessed a subset of incomplete model weights and datasets.

Fireworks says these were not affected:

• Payment card numbers. Fireworks says it does not store them.
• Inference, the Training SDK and Nexus. These are zero data retention by default, so prompts and outputs are not stored.

Not known from the bulletins:

• How many customers were affected. Fireworks does not give a number.
• Which third-party cloud provider was breached.
• Who the attackers are. Fireworks says the evidence points to a financially motivated criminal group that sells tokens obtained through unauthorized access to AI models, via illicit routing gateways. It names no group.

The October bulletin said Fireworks had found no evidence of access to customer models, datasets or training data. The November update reverses that for some customers. If you read only the first bulletin, your picture is out of date.

What is LLMJacking?

LLMJacking means hijacking a company's access to large language models (LLMs) and making money from it. Fireworks' update points to a November 2 report from Google Threat Intelligence Group and Mandiant, which describes the pattern:

• Criminals steal cloud credentials, service account keys, GitHub tokens or AI API keys.
• They pool the stolen keys behind "LLM Mixers", gateways that resell cheap AI access to underground subscribers.
• The victim pays the bill. Mandiant saw fraudulent charges above $100,000 in a single day in some incidents, and up to $1 million in total at some organizations before access was cut off.

Google's report does not mention Fireworks. Nothing published so far says the group behind the Fireworks attack is one of the groups Google describes. Still, the report shows why stolen AI keys are worth money, and why a platform holding many customers' keys is a target.

Who is affected

Fireworks says it is contacting customers whose data was affected and will give them details and recommended steps. If you have not received a notice, Fireworks has not identified your account as affected. The October bulletin said no incident-specific action is needed in that case.

The risk reaches past Fireworks itself. Many teams stored keys for other services as Fireworks secrets so their evaluation jobs could call them: cloud accounts, other AI providers, databases. Any of those keys may now be in an attacker's hands.

What to do this week

Fireworks says it can share secret names and credential fingerprints over a secure channel to help you match exposed keys. Contact details are in the bulletin.

Why this matters for a business using an AI platform

An AI platform account holds more than a login. It can hold keys to your other systems, your customer data in training sets, and the fine-tuned models you paid to build. When the platform is breached, all of that is exposed at once, even if your own systems were never touched.

Three things to put in place before you sign with any AI provider:

• Know what you store there. Keep a list of every secret, dataset and model you upload. If you don't know what was on the platform, you can't rotate it after a breach.
• Get notification terms in writing. Your agreement should say how fast the vendor will tell you about an incident and what details you will get.
• Keep your own copies and controls. Hold the master copies of your training data and model weights yourself. Some companies run sensitive AI workloads on their own servers instead of a shared platform.

If running models on infrastructure you control makes sense for your company, our self-hosting and infrastructure page explains what that involves.

Fireworks AI breach questions people are asking

Was my Fireworks API key stolen?

Fireworks revoked the API keys it identified as affected and is notifying those customers directly. If you got no notice, Fireworks has not identified your account as affected.

Were my prompts and outputs exposed?

Fireworks says it found no impact on Inference, the Training SDK or Nexus. Those are zero data retention by default, so prompts and outputs are not stored.

Were credit card numbers stolen in the Fireworks hack?

No. Fireworks says it does not store payment card numbers. Billing addresses, invoice and payment history, balances and credit usage were accessed.

What is LLMJacking?

It is the theft of access to AI models, usually through stolen keys or cloud credentials. Criminals resell that access, and the victim pays the usage bill.

If I delete a secret from Fireworks, is it safe?

No. Deleting a stored secret does not invalidate the key itself. Revoke or rotate it with the provider that issued it.

Was the Fireworks AI breach the same group Google reported on?

Not confirmed. Fireworks cites Google's LLMJacking report, but neither Fireworks nor Google says it was the same group.

What features has Fireworks disabled?

Self-serve dataset uploads and downloads for Batch Inference and dataset-based training are off while the investigation continues. The Training SDK is still available.

The bigger lesson

Every platform you hand a key to becomes part of your security. Keep a list of what you store with each vendor, scope every key so a leak stays contained, and set spending alerts so you learn about misuse within hours, not when the invoice arrives.

To harden your systems and keys before the next vendor breach, see security hardening or request a quote.

Get security alerts by email, with the free checklist, at security alerts.

Sources: Fireworks AI: Update on October 2026 security incident; Fireworks AI: October 2026 security incident; Google Threat Intelligence Group and Mandiant: The Rise of LLMJacking.