The short version
Fireworks AI says attackers reached billing data for its customers and, for some of them, stored datasets and unfinished model weights. The inference and fine-tuning provider widened its October breach disclosure on November 9, 2026, after finding a second intrusion through a third-party cloud provider. If you upload training data to a hosted platform for LLM fine-tuning, that data and the weights built from it now need the same protection plan as your own databases.
What did Fireworks AI disclose?
The November 9 update widened the breach to customer data. Fireworks says a third-party cloud provider that hosted its research and development machines suffered its own security incident on October 23. The next day the attacker used that foothold to reach Fireworks development machines and run an unauthorized workload. Fireworks says it detected the activity the same day and has seen no further successful access to the customer platform since October 25.
That is a reversal of the first bulletin, published on October 9, which described a narrow incident. On October 6 an outsider used internal Fireworks credentials to read environment variables in evaluation jobs, which captured API keys and tokens that a limited number of customers had stored as secrets. At that point Fireworks said it had found no sign of access to customer models, datasets, training data or inference traffic.
| Date (2026) | Event |
|---|---|
| October 6 | Unauthorized use of internal credentials detected; containment starts |
| October 9 | First bulletin: secrets in evaluation jobs captured in a limited number of accounts |
| October 23 | Third-party cloud provider hosting Fireworks R&D machines is breached |
| October 24 | Attacker reaches Fireworks development machines and runs an unauthorized workload |
| November 9 | Update: billing data, plus some datasets and incomplete model weights, affected |
What data was exposed?
The internal application the attacker reached gave access to three groups of information:
- Resource metadata: identifiers, display names, descriptions and creation times of customer resources.
- Billing information: billing and shipping addresses, invoice and payment history, account balance and credit usage. Fireworks says it does not store card numbers.
- Model weights and datasets: for certain customers, a subset of incomplete model weights and datasets.
Fireworks has notified law enforcement, brought in Palo Alto Networks Unit 42 for forensics, and disabled self-serve dataset uploads and downloads for Batch Inference and dataset-based training while it investigates. Bloomberg, citing a person familiar with the matter, reported that the breach involved tens of thousands of files.
Why does this matter beyond Fireworks?
Fireworks is a major independent inference provider. Forbes reports it has about 10,000 enterprise customers, including Uber, Shopify, Upwork and DoorDash, and a $17.5 billion valuation. Two customers told Forbes they had moved most of their business off the platform.
The attackers were not after the data itself, according to Fireworks. The evidence links them to a group that sells stolen access to large language models through illicit routing gateways, a scheme known as LLMjacking. Google Threat Intelligence Group and Mandiant described the same trend on November 2. That makes any AI platform holding customer API keys, cloud credentials and GPU capacity an attractive target, and the customer data around it collateral damage.
What it means for US & EU software teams
A hosted training platform is a data processor, not just a compute vendor. Datasets uploaded for fine-tuning often contain support tickets, contracts or customer records, and models trained on them can retain fragments of that data.
In the EU, if personal data was in an exposed dataset, the controller (usually you, not the vendor) has 72 hours from becoming aware of a reportable breach to notify the supervisory authority under GDPR. That clock depends on how fast your vendor tells you, so check the notification terms in your data processing agreement.
The route in matters too. Fireworks was reached through a provider one step down its own supply chain. Your vendor's sub-processor list is part of your risk surface.
Finally, secrets stored inside an AI platform, such as keys for your databases, vector stores or other model providers, are a direct path into your own systems. They should be scoped, short-lived and rotatable without a code release.
What should teams using hosted AI platforms do now?
- Act on any notice. Fireworks customers should replace revoked keys and rotate third-party credentials with the providers that issued them; deleting a stored secret does not invalidate it.
- Map what you uploaded. List the datasets and fine-tuned models held by each AI vendor, and whether they contain personal or regulated data.
- Minimize data at rest. Prefer zero-data-retention modes, delete finished training sets, and strip or pseudonymize personal data before upload.
- Cap and watch spend. Set hard usage limits and alerts per key; sudden token spikes are a typical sign of LLMjacking.
- Read the sub-processor list. Confirm where your vendor's training and R&D workloads run and how fast it must notify you.
Frequently asked questions
What happened at Fireworks AI?
On October 6, 2026 Fireworks AI detected unauthorized use of internal credentials, which exposed secrets stored in evaluation jobs for a limited number of customer accounts. In a November 9 update it said a second intrusion on October 24, launched through a breached third-party cloud provider that hosted its R&D machines, also affected account and billing data and, for some customers, datasets and incomplete model weights.
What data was exposed?
Fireworks lists resource metadata such as identifiers, names and descriptions; billing information such as addresses, invoices, payment history, account balance and credit usage; and, for certain customers, a subset of incomplete model weights and datasets. It says it does not store payment card numbers and they were not affected.
Were inference prompts and outputs affected?
Fireworks says it has not detected any impact to its Inference, Training SDK or Nexus products, which run with zero data retention by default. It also says the investigation is ongoing and may reveal more.
What is LLMjacking?
LLMjacking is the theft of access to large language models, usually through stolen API keys or cloud credentials, so that criminals can resell the model capacity through illicit routing gateways while the victim pays the bill. Fireworks links the attackers behind its incident to a financially motivated group of this kind.
What should Fireworks customers do?
Follow the instructions in any notice from Fireworks, replace revoked API keys, rotate third-party credentials that were stored as Fireworks secrets with the providers that issued them, and review those providers' logs for unauthorized reads, downloads or changes. Self-serve dataset uploads and downloads for Batch Inference and dataset-based training are disabled while the investigation continues.
Sources
Fireworks AI — Update on October 2026 security incident (primary source, November 9, 2026)
Fireworks AI — October 2026 security incident (original bulletin, October 9, 2026)
Bloomberg — Nvidia-backed Fireworks AI notifies customers of its second hack in weeks (November 9, 2026)
Forbes — Fireworks cyberattack exposes customer data and AI models as fallout widens (November 9, 2026)
BleepingComputer — Fireworks AI discloses new breach after cloud provider hack (November 2026)