Fireworks AI breach exposed customer data and incomplete model weights
Original title: Hackers Breach Fireworks AI Through Third-Party Cloud Provider to Steal Customer Data
An unnamed cloud provider incident on October 23 let attackers reach development machines and customer datasets the next day.
Fireworks AI said a November 9, 2026 update widened an October breach beyond stolen evaluation-job secrets. Attackers used a third-party cloud incident to access development machines on October 24 and run an unauthorized workload. Exposed data includes account identifiers, billing records, and, for some customers, incomplete model weights and datasets. Payment card numbers were not stored. The company says customer-platform access was not detected after October 25, and the investigation continues.
Unconfirmed: Fireworks attributes the intrusion to a financially motivated group seeking LLMJacking; the provider, vulnerabilities, and full scope remain unconfirmed.
- The first incident began October 6 with misuse of credentials that could capture API keys and tokens.
- Fireworks revoked affected keys, employee credentials, and service-account tokens and began notices on October 7.
- Inference, Training SDK, and Nexus were reported unaffected and use zero data retention by default.
- Self-service dataset uploads and downloads for Batch Inference and dataset training are disabled.
- Palo Alto Networks Unit 42 is supporting forensics, and law enforcement was notified.
Impact: Account details, billing records, datasets, and incomplete model weights exposed
- 1.Replace revoked Fireworks keys and rotate exposed third-party credentials with their issuers.
- 2.Review access logs, unfamiliar users, API keys, training jobs, and datasets for unauthorized activity.
- Victims
- Fireworks AI
- Organizations
- Palo Alto Networks
From the original article
3 min read at cybersecuritynews.com
Fireworks AI has disclosed a wider security breach involving customer account details, billing records, datasets, and incomplete model weights. In a November 9, 2026 update, the company said attackers reached its development machines through a third-party cloud provider, expanding the impact beyond the exposed credentials reported in October. The findings change the picture presented in […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.