THE CRUNCH
Fireworks AI has disclosed that two October attacks exposed more customer data than it first admitted, including billing records, datasets and incomplete model weights. The company, which lets customers train and run AI models, initially reported on October 9 that attackers had used internal credentials to reach environment variables in evaluation jobs, including some customers' API keys and tokens, and said at the time it found no evidence of access to models, datasets or personal information. Monday's update substantially broadens that picture.
The second incident came on October 23, when a third-party cloud provider hosting Fireworks' research and development machines was compromised. Attackers used that access the following day to reach Fireworks development systems and run an unauthorised workload. Fireworks suspects links to financially motivated criminals involved in LLMJacking, a tactic in which hackers hijack an enterprise's access to large language models and resell it through illicit gateways.
The affected data falls into three groups: resource metadata such as identifiers and descriptions; billing information including addresses, invoice and payment histories and account balances, though payment card numbers are not stored and were unaffected; and, for certain customers, a subset of incomplete model weights and datasets. Fireworks CEO Lin Qiao said the apparent motive was not stealing model weights: "From what we see attackers are not after weights. Most downloads were partial and stopped."
The fallout has reached other companies. Notion told Render CEO Anurag Goel that his workspace was among fewer than 1% of Notion workspaces whose AI chat transcripts may have been exposed, and said the transcripts lacked separate information linking them to particular users or workspaces. As Reddit users pointed out, however, the conversations themselves could contain identifying details. Notion has disabled its Insights feature, stopped serving open-weight models through Fireworks and advised affected customers to rotate any credentials they pasted into Notion AI during the incident.
Fireworks worked with Palo Alto Networks' Unit 42 to remediate, rotating credentials, isolating affected systems and tightening data storage access and monitoring. Neither update states how many customers were affected by either attack, though The Record reports impacted customers have been notified. Bloomberg reports Fireworks is also working with customers including Cursor and Harvey to assess the impact.
Key dates
Fireworks October breaches
October 9
Fireworks reported attackers used internal credentials to reach environment variables in evaluation jobs
October 23
A third-party cloud provider hosting Fireworks' research and development machines was compromised
Dates from The Register, as quoted in this brief.