Fireworks AI, the San Mateo company that hosts and fine-tunes open AI models for businesses, has confirmed that its October breach reached far more customer data than it first disclosed. In an updated security bulletin dated November 9, the company said attackers accessed account and billing information and, for a limited set of accounts, stored secrets, datasets and incomplete model weights.
The update also discloses a second intrusion. A third-party cloud provider that hosted Fireworks research and development machines was breached on October 23, and the attacker used that foothold on October 24 to reach Fireworks development machines and run an unauthorized workload that led to additional customer data impact.
From stolen secrets to billing records
Fireworks first went public on October 9. Its original bulletin said it spotted unauthorized use of internal Fireworks credentials at 9 AM PDT on October 6, and that an outside party had read environment variables used in evaluation jobs in a limited number of customer accounts. Those variables included API keys and tokens that customers had stored as secrets. At the time, the company said it had found no evidence of access to models, datasets, training data, inference traffic or personal information.
That picture has changed. Fireworks now says the affected internal application exposed 3 categories of data:
- Resource metadata: resource identifiers, display names, descriptions and creation times.
- Billing information: billing and shipping addresses, invoice and payment history, account balance and credit usage. Fireworks says it does not store payment card numbers, so none were taken.
- Model weights and datasets: for certain customers, a subset of incomplete model weights and datasets.
Fireworks has not said how many customers were affected or named the cloud provider behind the second incident. It says it caught the October 24 activity the same day and has seen no successful unauthorized access to its customer platform since October 25. Inference, the Training SDK and Nexus, which run with zero data retention by default, show no impact so far.
An LLMJacking crew, not yet named
Fireworks notified law enforcement and brought in Palo Alto Networks Unit 42 for forensics. The company says the evidence points to a financially motivated cybercriminal group that sells tokens from hijacked access to large language models to illicit routing gateways, a practice known as LLMJacking. Fireworks did not name the group, and no gang has publicly claimed the attack.
Fireworks pointed readers to a November 2 report from Google Threat Intelligence Group and Mandiant on the rise of LLMJacking, which describes attackers reselling stolen model access.
Fireworks also leads the list in Wiz’s “Black October” tracker of AI developer platforms hit during October. That tracker, which BreachNews covered alongside the Northflank breach, also includes Railway’s decrypted customer secrets, the Zeabur attack that forced a shutdown, Warp’s vendor breach and Chainstack’s data breach. Wiz says Fireworks reported signs of an “agent swarm” attack.
Notion pulls the plug on Fireworks
Notion has published its own notice of downstream impact. In a security advisory last updated November 9, Notion said Fireworks told it on the evening of November 2 that a small set of data had been accessed. That first dataset held Notion AI synthetic testing data and no customer data. By the morning of November 3, Notion had disconnected its systems from Fireworks, deleted all of its data in the Fireworks system and stopped all communication with the vendor.
On November 6, Fireworks warned that potential customer data may also have been accessed, and it confirmed the new dataset on November 8. Notion found it contained Notion AI chat transcripts used for its Insights feature, affecting fewer than 1% of Notion workspaces. For the vast majority of those workspaces, the chats were unattributable, meaning they carried no author or workspace labels and no tool call results.
Notion has disabled Insights, stopped serving open-weight models through Fireworks and told affected customers to treat the transcripts as exposed and to rotate any passwords, API keys or credentials pasted into Notion AI during the incident window.
Other customers weigh their exposure
According to reports, a Fireworks spokesperson said the company is working with customers including Notion and Cursor, and legal AI company Harvey says none of its customers’ data was affected. In a podcast interview on November 7, Cognition security chief Alex Stamos alleged that keys stolen from Fireworks were used to break into Cursor and push a malicious plugin to about 5,000 companies. Neither Fireworks nor Cursor has confirmed that link. Cursor’s own October 29 notice on the trojanized Claude Code extension does not mention Fireworks, and Cursor had not issued any public statement about the Fireworks incident at time of publication.
What Fireworks customers should do now
Fireworks says it revoked and replaced credentials and service accounts, isolated affected systems, tightened access to data storage and expanded logging. It has also disabled self-serve dataset uploads and downloads for Batch Inference and dataset-based training while the investigation continues.
Customers should replace any revoked Fireworks API keys, rotate every third-party credential named in their notice with the provider that issued it, review those providers’ logs for unauthorized activity and report any unfamiliar API keys, users, evaluators, training jobs or datasets to Fireworks. Deleting a stored secret from the Fireworks dashboard does not invalidate the underlying key.
