Fireworks AI says a second intrusion reached billing details, datasets and partial models

Fireworks AI, a company that runs and fine-tunes open AI models for developers and businesses, has published an update to its October security incident, dated November 9, 2026. The first bulletin said an attacker had read secrets stored for evaluation jobs in a limited number of customer accounts. The update says the impact is wider: account and billing information, and for a limited set of accounts, secrets, datasets and incomplete model weights.

Two incidents, one attacker

October 6. Fireworks says it found someone using internal Fireworks credentials. The attacker read environment variables used in evaluation jobs, which can include API keys and tokens customers store as secrets. Fireworks began notifying affected customers on October 7, published its bulletin on October 9 and revoked or rotated employee API keys, affected customer keys and service-account tokens over the following days.

October 23 and 24. In the update, Fireworks says a third-party cloud provider that hosted its research and development machines had its own security incident on October 23. On October 24, the attacker used that access to reach Fireworks development machines and run an unauthorized workload, which led to more customer data being exposed. Fireworks says it detected this the same day, closed known critical vulnerabilities and, as of October 25, has seen no further successful access to the platform customers use. It hasn’t named the cloud provider.

Fireworks says the evidence links the attacks to a financially motivated cybercriminal group that sells stolen access to large language models through illicit routing gateways, a practice known as “LLMjacking.” It is working with Palo Alto Networks Unit 42 and has notified law enforcement.

What was exposed

Fireworks says the affected internal application gave access to:

• Resource metadata: resource IDs, display names, descriptions and creation times
• Billing information: billing and shipping addresses, invoice and payment history, account balance and credit usage. Fireworks says it doesn’t store payment card numbers, so those weren’t affected
• Model weights and datasets: for certain customers, a subset of incomplete model weights and datasets

That’s in addition to the secrets from the October 6 incident. Fireworks says it has seen no impact to its Inference, Training SDK or Nexus services, which don’t retain customer data by default. It has turned off self-serve dataset uploads and downloads for batch inference and dataset-based training while the investigation continues.

What this means for you

This mostly affects developers and companies with Fireworks accounts. If you only use an app that happens to run on Fireworks, there’s nothing for you to change, though the app’s maker may need to rotate keys. If you have an account and got a notice, the important part is the third-party secrets: an API key for another service stored in Fireworks keeps working until you revoke it with that service.

What you can do (Fireworks customers)

1. Replace revoked Fireworks API keys you still need and update the apps that used them.
2. Rotate every third-party credential named in your notice with the provider that issued it. Fireworks points out that deleting a stored secret doesn’t invalidate it.
3. Review the logs of those third-party services for reads, downloads or changes you don’t recognize, and follow their guidance if you find any.
4. Check your Fireworks account for API keys, users, evaluators, training jobs or datasets you don’t recognize and report them to security-notice@fireworks.ai, the contact Fireworks lists.
5. Treat billing-themed messages with care. Billing addresses and invoice history are enough to make a fake invoice look real.

How Frame helps

Frame tracks breaches that expose personal details like email and billing addresses. If this one is added to a breach catalog, add it to a verified email in Frame and Frame shows what it exposed and gives you a short checklist. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame never collects or stores the leaked records themselves, and it doesn’t manage API keys.

Related coverage

• Northflank tells every customer to assume their secrets were decrypted: another cloud platform where stored environment variables were the target, and where rotating keys at the source was the fix.
• Railway says some customer environment variables may have been read: the same kind of exposure at a different developer platform.

Sources

• Fireworks AI, Update on October 2026 security incident, last updated November 9, 2026
• Fireworks AI, Fireworks October 2026 security incident, October 9, 2026
• BleepingComputer, Fireworks AI discloses new breach after cloud provider hack, November 2026