Fireworks AI, the Nvidia-backed startup that helps companies run AI models, disclosed on November 9 that a second security incident in October exposed customer datasets, incomplete model weights and billing information, widening the Fireworks AI breach the company first reported a month earlier. Bloomberg Law called it the company’s second known hack in a matter of weeks.

The update, published in Fireworks’ official security bulletin, says the newly discovered impact goes well beyond the stored secrets that were all the company knew about in October. “For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models,” the company wrote. Fireworks says it is notifying affected customers with details and recommended response actions.

What the Fireworks AI Breach Exposed

The affected internal application provided access to several categories of customer information. Resource metadata included identifiers, display names, descriptions and creation times. Billing information included billing and shipping addresses, invoice and payment history, account balances and credit usage. For certain customers, a subset of incomplete model weights and datasets was accessed. Payment card numbers were not affected, because Fireworks says it does not store them.

Fireworks said it has not detected any impact to Inference, Training SDK or Nexus, which it describes as zero data retention by default. The company cautioned that its investigation is ongoing and may reveal additional information.

Timeline of the Fireworks AI October 2026 security incidents, from the first breach on October 6 to the wider disclosure on November 9
How the October 2026 incidents unfolded. Graphic: GPTOnline. Source: Fireworks AI security bulletin.

How the Second Intrusion Happened

The second intrusion began outside Fireworks. A third-party cloud provider hosting the company’s research and development machines experienced a security incident on October 23. On October 24, an unauthorized party used that opening to reach Fireworks development machines and run an unauthorized workload that led to the additional customer data impact.

Fireworks said it detected the activity the same day and took immediate remediation measures, including closing known critical vulnerabilities. As of October 25, it had not detected further successful unauthorized access by the attacker on the customer platform.

A Link to LLMjacking

Fireworks said the evidence indicates links to a financially motivated cybercriminal group aimed at selling tokens from unauthorized access to large language models to illicit routing gateways, activity known as LLMjacking. Google’s Threat Intelligence Group and Mandiant described the same tactic in a report published November 2, warning that stolen cloud access is being resold while victims are billed up to $1 million.

What Fireworks Is Doing About It

Fireworks notified law enforcement and brought in Palo Alto Networks’ Unit 42 for forensic analysis and security hardening. Working with Unit 42, the company revoked and replaced credentials and service accounts, removed unnecessary elevated permissions, restricted network pathways, isolated affected systems and tightened access to storage and analytics systems.

As part of its response, Fireworks disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training while it investigates. Training SDK remains available without training data stored at rest, and training through Fireworks Lab operates in an isolated environment with additional network and storage protection.

Fireworks AI branding
Fireworks AI. Image: Fireworks AI.

Customer Fallout

Two customers told Forbes they had substantially moved their business off Fireworks’ systems, and one described a series of “very bad hacks” while criticizing the company’s communication about the attacks. Two other customers interviewed by Forbes said they were unaware of any Fireworks hacks. Fireworks has over 10,000 customers, including the legal tech firm Harvey, productivity software startup Notion and coding company Cursor, according to Bloomberg Law.

The first incident was found on October 6, when Fireworks identified unauthorized use of its own internal credentials to read environment variables used in evaluation jobs in a limited number of customer accounts. API keys and tokens stored as secrets in some affected accounts were likely captured. Security firm Wiz counted nine AI developer platforms that disclosed incidents in October, a wave we covered in our earlier report.

Why It Matters

Model weights and training datasets are among the most sensitive assets an AI company holds, and even incomplete weights can help rivals or feed distillation efforts that copy a model’s behavior. A second incident in a single month, this time arriving through a third-party provider, also underlines how exposed AI infrastructure companies are to their own supply chains. Customers should rotate API keys at the provider that issued them, not only in the Fireworks dashboard, and check billing for models, volumes or regions they do not recognize.

Sources