Fireworks AI Breach Widens to Billing Data and Model Weights

Fireworks AI, an AI infrastructure provider, widened its account of an October breach on Monday. The company now says attackers also reached billing records, datasets and incomplete model weights for some customers. Notion, one of its customers, says AI chat transcripts were in the stolen data.

What changed in the disclosure

Fireworks first reported the incident on 9 October 2026 (Pacific time; 10 October UTC). It had spotted unauthorized use of internal credentials on 6 October. At that point it said an outside party had captured environment variables used in evaluation jobs, including API keys and tokens stored as secrets, in a limited number of customer accounts. It said it had not detected evidence of unauthorized access to models, datasets, training data, personal information or inference traffic within its security perimeter or control.

The update changes that picture. Fireworks says it later found impact to account and billing information. For a limited set of accounts, it also found impact to secrets, datasets and incomplete models. The affected internal application provided access to three categories of data. The update says only that, for certain customers, a subset of incomplete model weights and datasets was accessed:

• Resource metadata, such as identifiers, display names, descriptions and creation times.
• Billing information, such as billing and shipping addresses, invoice and payment history, account balance and credit usage. Fireworks says it does not store payment card numbers and none were affected.
• For certain customers, a subset of incomplete model weights and datasets.

A second intrusion through a cloud provider

The update describes a second event. A third-party cloud provider that hosted Fireworks research and development machines had its own security incident on 23 October. On 24 October, Fireworks says, an unauthorized third party used that provider to reach Fireworks development machines and run an unauthorized workload, which led to the additional customer data impact. Fireworks says it detected this the same day and that, as of 25 October, it had not detected further evidence of successful unauthorized access to the platform customers use. That statement is as of 25 October; the update was published on 9 November. The update does not say whether the same actor was behind both events, and Fireworks has not named the cloud provider.

Fireworks says it has not detected any impact to Inference, the Training SDK or Nexus, all of which are zero data retention by default. It describes these findings as based on its investigation to date.

Link to LLMjacking

Fireworks says the evidence indicates links to a financially motivated criminal group whose aim is to sell tokens from unauthorized LLM access to illicit routing gateways, a practice known as LLMjacking. It cites the Google Threat Intelligence Group and Mandiant report published on 2 November.

That report describes LLMjacking incidents in which fraudulent charges passed $100,000 in a single day and reached $1 million at some organizations before access was revoked. Google observed threat actors using open-source API gateways to pool stolen credentials and resell the access. Google lists budget alerts, quotas, least privilege and monitoring for max_tokens=1 validation requests among its mitigations.

Downstream impact at Notion

Notion published its own notice. It says Fireworks told it on 2 November that a small set of data had been accessed, which included synthetic testing data. Notion said no Notion AI customer data was involved in that dataset. By 3 November Notion had disconnected from Fireworks and deleted its data there. On 6 November Fireworks said customer data may have been accessed, and on 8 November it confirmed a new dataset.

Notion says that dataset included Notion AI chat transcripts used for its Insights feature. For the vast majority of affected workspaces the chats were unattributable: not labeled with an author or workspace, and without tool call results. Notion says fewer than 1% of workspaces are affected. It has disabled Insights and no longer serves open-weight models through Fireworks. It advises affected customers to rotate any credentials they pasted into Notion AI during the incident window.

What defenders should take from it

Fireworks has disabled self-serve dataset uploads and downloads for Batch Inference and dataset-based training. The update says notified customers get recommended response actions but publishes no new guidance. The original bulletin gave notified customers these steps and says those without a notice need no incident-specific action. AISW suggests any team that stored secrets with an AI platform consider them too:

1. Revoke exposed third-party credentials with the issuing provider. Removing a stored secret does not invalidate it.
2. Review logs and data reachable with those credentials, even if nothing looks suspicious, and rotate regardless.
3. Check for API keys, users, evaluators, training jobs and datasets you do not recognize.

Our judgement: the broader lesson is about where secrets live. Evaluation jobs, fine-tuning pipelines and chat-based features hand credentials and sensitive text to a vendor, and a breach at that vendor, or at the vendor’s cloud host, can reach whatever those features hold.

References

• Fireworks AI — Update on October 2026 security incident
• Fireworks AI — Fireworks October 2026 security incident
• Notion — Fireworks AI incident
• Google Cloud Threat Intelligence — The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources
• The Record — AI company Fireworks says hackers stole data, billing info during October breaches
• The Hacker News — Fireworks AI Breach Widens to Expose Customer Billing Data and Incomplete Model Weights