Fireworks AI, which runs inference and fine-tuning for other companies' models, published an update on November 9, 2026 to a security bulletin it first issued on October 9. The first bulletin said someone had used internal Fireworks credentials on October 6 to read "environment variables used in evaluation jobs in a limited number of customer accounts", including "API keys and tokens stored as secrets". It added that Fireworks had "not detected evidence of unauthorized access to customer models, datasets, training data, personal information, or inference traffic".
The update changes that picture. "Since then, we discovered impacts to account and billing information. For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models."
How the second intrusion happened
According to the update, "a third-party cloud provider that hosted Fireworks R&D machines experienced a security incident on October 23." On October 24 the attacker "used it to reach Fireworks development machines and then run an unauthorized workload that led to additional customer data impact." Fireworks says it detected this the same day and has seen no further successful access since October 25. The affected data includes:
- Resource metadata, such as identifiers, display names and descriptions.
- Billing information, including billing and shipping addresses, invoice and payment history, balances and credit usage. Fireworks says it does not store card numbers.
- Model weights and datasets, "a subset of incomplete model weights and datasets" for certain customers.
Fireworks says it found no impact on its Inference, Training SDK and Nexus products, which do not retain data by default. It has disabled self-serve dataset uploads and downloads for batch inference and dataset-based training while it investigates, and is working with Palo Alto Networks Unit 42.
Why the attackers wanted it
Fireworks links the activity to a financially motivated group "aimed at selling tokens from unauthorized access to Large Language Models (LLMs) to illicit routing gateways", a practice known as LLMjacking, and points to a November 2 post by Google Threat Intelligence Group and Mandiant on the trend. In this model of attack, the stolen asset is the ability to run models at someone else's expense, so a provider's API keys and the secrets customers store with it are valuable even without the data.
The Hacker News reports that Notion disclosed an impact on "fewer than 1% of Notion workspaces". Notion said the data "included Notion AI chat transcripts used for the Insights feature", mostly not attributable to a person or workspace, and that it had disabled Insights and stopped serving open-weight models through Fireworks.
What remains uncertain. Fireworks has not said how many customers were affected, how much data was taken or which cloud provider was involved. It says its investigation "may reveal additional information", so this may not be the final scope.
Analysis: The first bulletin was careful to say "at this time", and the second shows why that wording matters. If Geetha's team at Belgavi's Book Store fine-tuned a returns classifier with a hosted provider, it should know which datasets and checkpoints still sit there and delete what is no longer needed. Keep provider keys narrowly scoped, set spending alerts, since LLMjacking first appears as a bill, and rotate stored third-party credentials with their issuers. As Fireworks' own first bulletin noted, deleting a stored secret does not revoke it.
Sources and evidence
Fireworks AI's November 9 update widens its October breach: a second intrusion via a third-party cloud provider reached billing records and, for some accounts, secrets, datasets and incomplete model weights. It ties the attack to LLMjacking, and Notion says under 1 percent of its workspaces were affected. Inventory data held at providers, scope keys, alert on spending and rotate stored credentials.