Fireworks AI breach: second intrusion exposed billing data, datasets and partial model weights

A breach at an AI inference vendor does not stay at the vendor. Fireworks AI, which hosts open models for developers, disclosed on November 9, 2026 that attackers reached its research and development machines through a compromised cloud provider. A day later, BleepingComputer reported the same details. Notion, one of the vendor's customers, says chat transcripts from fewer than 1% of its workspaces were taken.

What happened and when

Fireworks published its first bulletin on October 9, 2026. In that incident, an unauthorized party used internal Fireworks credentials to read environment variables holding API keys and tokens for a limited number of customer accounts, according to the company and to eSecurityPlanet, which dates first detection to October 6.

The second incident is the new one. According to the updated bulletin, a third-party cloud provider that hosts Fireworks' R&D machines had its own security incident on October 23. On October 24, an unauthorized party used that access to reach Fireworks development machines and run an unauthorized workload, which caused additional customer data impact. Fireworks says it detected this the same day, and on October 25 reported no further evidence of successful unauthorized access to the platform customers use.

The bulletin lists what was reached for some customers. That includes resource metadata such as identifiers and display names, and billing information such as billing and shipping addresses, invoice and payment history, account balance and credit usage. For a limited set of accounts it also includes secrets, datasets and a subset of incomplete model weights. In the company's words, "Payment card numbers are not stored by Fireworks and were not impacted."

The downstream victim

Notion's advisory, published November 9, gives the clearest customer-side timeline. Fireworks told Notion on the evening of November 2 that a small set of data had been accessed. Notion disconnected from Fireworks the next morning, deleted the data in the vendor's system and stopped all communication. On November 6, Fireworks said malicious actors may have accessed potential customer data. On November 8 it confirmed a second dataset.

The first dataset was Notion AI synthetic testing data, and Notion says no customer data was involved. The second held chat transcripts used for its Insights feature. For most affected workspaces the chats could not be attributed to a user, company or workspace, and the transcripts did not include tool call results. TechCrunch, which broke the story, quotes Notion as saying the transcripts include "any input to or output from the model that was written to the chat."

Notion has disabled Insights, stopped serving open-weight models through Fireworks and contacted affected customers. Its guidance is blunt: "treat this data as if it were exposed," and rotate any passwords or API keys that were pasted into Notion AI during the incident period. It also says that if a workspace has not been contacted, "no action is needed right now."

Render's chief executive said on X that Render was also affected, according to eSecurityPlanet. TechCrunch lists Harvey and Cursor among Fireworks customers, and notes this is the second breach in as many months.

Who was behind it

Fireworks says the evidence for the October incident "indicates links to a cybercriminal threat actor group" that is financially motivated and aims to sell unauthorized access to large language models, a practice called LLMjacking. The attackers are unnamed. Fireworks does not attribute the October 23 and 24 breach to a specific actor, and the evidence does not establish that one group was behind both. Google's Threat Intelligence Group and Mandiant published a report on LLMjacking on November 2, 2026, describing fraudulent charges above $100,000 in a single day in individual incidents.

What Fireworks says it has done

The company notified law enforcement and engaged Palo Alto Networks Unit 42 for forensic analysis. It revoked and replaced credentials and service accounts, removed unnecessary elevated privileges, isolated affected systems, tightened access to storage and analytics, and improved logging. Self-serve dataset uploads and downloads for Batch Inference and dataset-based training are disabled while the investigation continues. Inference, the Training SDK and Nexus, which run with zero data retention by default, were not impacted, it says. The bulletin is marked active monitoring.

What is still unclear

Three gaps matter. The bulletin does not say how many customers had weights or datasets exposed, only that it was a limited set. It gives no list of affected customers, so those who were not notified cannot tell from the page alone. And it does not state whether the unfinished model weights belonged to frontier-scale systems or small fine-tunes. Those answers decide whether this is a billing-data problem or a model-theft problem.

This also fits a pattern we have been tracking. Our report on the Railway breach described the same market for stolen AI access from the victim side.

What customers of any AI vendor should check

BleepingComputer's closing advice is aimed at every organization that buys model access, not only Fireworks customers. It argues that organizations should limit vendor access, track what data each provider holds, be ready to revoke credentials and rotate secrets quickly, plan how vendors will notify them of incidents, and tell their own customers which third parties handle their data. Notion's timeline illustrates why: it learned of the first incident on the evening of November 2, cut the connection the next morning, and still received a second, larger disclosure on November 6 and a confirmation on November 8.

Three practical checks follow from the records we opened. Does your vendor offer zero data retention, which Fireworks says shielded its inference, Training SDK and Nexus services? Where do your keys live, and could a vendor employee or a vendor's cloud host read them? And what is the contract's notification window, given that the second Fireworks disclosure came more than two weeks after the October 23 cloud provider incident?

Our take

The lesson is dull and urgent. Every hosted model vendor is now a data processor for whatever your staff type into an AI feature, and a breach three links down the chain, here a cloud provider hosting R&D machines, can reach you. We would rotate any key that touched Fireworks since early October, ask each AI vendor which sub-processors hold prompts, and set spending caps on every model account. We would watch for Fireworks to publish the count of customers with weights exposed, and for the identity of the cloud provider.