al-ice.ai

The R&D Cloud Was the Way In: Fireworks AI’s Second Breach Reached Billing Data, Datasets, and Model Weights

Agent & Supply Chain Security by al-ice.ai Editorial

On 9 November 2026, Fireworks AI updated its October security bulletin with a disclosure that is best read as a second breach, not an appendix to the first. The October incident this site covered on 25 October involved an intruder using internal credentials to capture environment variables — API keys and tokens — from evaluation jobs in customer accounts. The new update describes a different entry path, a different foothold, and a wider data set: on 23 October, a third-party cloud provider hosting Fireworks R&D machines suffered its own security incident; on 24 October, the unauthorized party used that foothold to reach Fireworks development machines and run an unauthorized workload that expanded the customer-data impact. Fireworks says it detected the activity the same day, closed known critical vulnerabilities, and as of 25 October has found no further evidence of successful unauthorized access. Law enforcement has been notified, and Palo Alto Networks Unit 42 assisted the forensic analysis.

What the second intrusion reached

At the time of the original 9 October bulletin, the company says, only Fireworks-stored secrets used in evaluation jobs were known to have been accessed. The investigation since found impact to account and billing information — and, for a limited set of accounts, to secrets, datasets, and a subset of incomplete model weights. The affected internal application exposed three categories, per the bulletin: resource metadata (identifiers, display names, descriptions, creation times); billing information (billing and shipping addresses, invoice and payment history, account balance, credit usage — with the explicit note that payment card numbers are not stored by Fireworks and were not impacted); and, for certain customers, incomplete model weights and datasets. Bloomberg reported on 9 November that notified customers include Notion and Cursor, and that Fireworks serves more than 10,000 customers — carried here as reported. Inference, Training SDK, and Nexus, all zero-data-retention by default, are stated to be unaffected, and the company says it is notifying impacted customers individually with response actions.

The motive is the market: LLMJacking

Fireworks attributes the activity to a financially motivated cybercriminal group whose business is selling tokens from unauthorized LLM access to illicit routing gateways — LLMJacking. That framing converges with two independent data points from the last ten days: Google’s Threat Intelligence Group and Mandiant published a 2 November blog post on the rise of LLMJacking, its motives, techniques, and mitigations, and this site’s October coverage documented the autonomous LLMJacking operation Symantec captured in the wild staging through exposed models. Stolen inference credentials have become inventory with a resale market, which explains why two Fireworks intrusions weeks apart both converged on the same asset class — first evaluation-job secrets, now account credentials, datasets, and weights. The weights angle deserves precision: the disclosure says a subset of incomplete weights for certain customers, which is not a claim of full production-model theft, but it is the first time this incident series has touched model artifacts at all.

Response and the third-party trust boundary

Working with Unit 42, Fireworks lists credential and service-account revocation and replacement, removal of unnecessary elevated privileges, network isolation of affected systems, tightened data-storage access, and hardened logging and monitoring — plus a concrete availability cost: self-serve dataset uploads and downloads for Batch Inference and dataset-based training are disabled while the investigation continues. Two defensive lessons stand out. First, the entry ran through a provider’s incident, not Fireworks’ perimeter: R&D machines hosted externally became the bridge to development machines holding customer-adjacent data, a reminder that third-party-hosted build and research environments inherit the provider’s compromise. Second, the bulletin’s timeline shows the actor moving from provider foothold to dev machines within a day — detection the same day limited, but did not prevent, the data impact. Read alongside the GitBook agent-infrastructure breach the same month, the pattern is platforms discovering that the systems around the model — eval jobs, dev machines, R&D clouds — are where the credentials live.

What to actually do

  1. Treat third-party-hosted R&D and build machines as production trust boundaries: inventory which providers can reach development systems holding customer data, require breach-notification paths in contracts, and isolate research environments so a provider incident cannot become a dev-machine foothold.
  2. Assume stolen inference credentials have a buyer: scope API keys per workload, rotate on any adjacent incident — not just confirmed key theft — and alert on usage from unexpected geographies, volumes, or routing gateways consistent with LLMJacking resale.
  3. Separate model-weight and dataset storage from development-machine reach: the incomplete-weights access in this incident is the warning shot for full-artifact theft, and self-serve dataset pipelines deserve the same isolation Fireworks has now imposed reactively.
  4. If you are a Fireworks customer, read the individual impact notice, not the bulletin summary: the company states per-customer notification with details and recommended actions, and the affected population differs sharply between billing-only and weights-and-datasets accounts.

Our verification was read-only. We read Fireworks AI’s official security bulletin update first-hand in full (last updated 9 November 2026: update to the 9 October bulletin; Palo Alto Networks Unit 42 forensics; law-enforcement notification; initial scope of evaluation-job secrets widened to account and billing information plus, for a limited set of accounts, secrets, datasets, and incomplete models; financially motivated LLMJacking attribution; Google/Mandiant 2 November LLMJacking reference; 23 October third-party cloud provider incident, 24 October development-machine access and unauthorized workload, same-day detection, no further successful access detected as of 25 October; billing-data categories with no stored card numbers; Inference, Training SDK, and Nexus ZDR unaffected; per-customer notification; self-serve dataset up/down disabled). Customer names (Notion, Cursor), the 10,000-customer figure, and the 10 November cloud-restoration report are carried as reported via Bloomberg (9 November), BleepingComputer (10 November), cybersecuritynews.com, and explainx.ai. We tested nothing, touched no Fireworks infrastructure, and contacted no vendor. Brave Search was used for discovery only.

Sources: