Fireworks AI, the platform companies use to run and train artificial intelligence models, has told customers that an October intrusion reached far more than it first reported. Attackers got to account and billing records, and for a limited set of accounts to stored secrets, training datasets and incomplete model weights.

The company published the update on 9 November as an extension of an incident it first disclosed on 9 October. It had first detected unauthorised use of its internal credentials on 6 October, and at that stage said only secrets stored for evaluation jobs were known to have been accessed. Five weeks later, the picture is wider. The update says attackers reached billing and shipping addresses, invoice and payment history, account balances and credit usage, and for certain customers a subset of incomplete model weights and datasets. Fireworks says it does not store payment card numbers, and those were not affected.

A second way in through a cloud provider

The update also describes a second intrusion path. A third-party cloud provider that hosted Fireworks research and development machines had its own security incident on 23 October, and the next day the intruder used it to reach Fireworks development machines and run an unauthorised workload. Fireworks has not named the cloud provider, and has not said how many customers were affected.

The company says it has seen no further successful access to the customer-facing platform since 25 October, and has found no impact so far on its Inference service, the Training SDK or Nexus, which it describes as zero data retention by default. Those findings are based on the investigation so far, and the investigation is continuing with Palo Alto Networks Unit 42. Law enforcement has been notified, and self-serve dataset uploads and downloads remain switched off while the work continues.

Linked to a scheme that resells AI access

Fireworks links the activity to a financially motivated criminal group that sells stolen access to large language models through illicit routing gateways, a pattern known as LLMJacking. The company serves more than 10,000 customers, and the breach has already had knock-on effects: Notion, one of its customers, has published its own advisory saying fewer than 1% of its workspaces were affected, and that the dataset confirmed on 8 November included Notion AI chat transcripts used for its Insights feature.

The incident matters because it moves the breach from a credential leak to a loss of AI assets. Model weights and training datasets are the core property of an AI company, and even incomplete weights can be valuable. Fireworks says it is notifying customers whose data was affected with account-specific details and recommended steps. A second independent report confirms the same dates, data categories and second intrusion path.