Fireworks AI has widened its disclosure of an October security incident, saying on 9 November 2026 that attackers reached customer billing information and, for a limited set of accounts, datasets and incomplete model weights. The update goes well beyond the company’s first bulletin, which had said only that stored secrets used in evaluation jobs had been accessed.

Fireworks, an AI infrastructure provider used by companies to run and fine-tune models, first detected unauthorised use of internal credentials on 6 October 2026 and began notifying affected customers on 7 October. Its first bulletin, published on 9 October, said it had found no evidence of unauthorised access to customer models, datasets, training data, personal information or inference traffic. The new update reverses part of that picture.

What the attackers reached

According to the 9 November update, the affected internal application gave access to three categories of information. The first was resource metadata, such as identifiers, display names, descriptions and creation times. The second was billing information, including billing and shipping addresses, invoice and payment history, account balances and credit usage. Payment card numbers were not affected, because Fireworks says it does not store them.

The third category applied to a limited set of accounts: a subset of incomplete model weights and datasets. Fireworks has not said that complete customer models were stolen, and it is notifying affected customers with account-specific details and recommended steps. Customers who received no notice have not been identified as affected so far, the company says.

A second intrusion through development machines

The update also describes a second route into the company. A third-party cloud provider that hosted Fireworks research-and-development machines experienced a security incident on 23 October. On 24 October, the intruder used that access to reach Fireworks development machines and run an unauthorised workload that led to additional customer-data impact. Fireworks says it detected the activity the same day, took remediation measures and closed known critical vulnerabilities, and has seen no further successful unauthorised access on the customer platform since 25 October.

Fireworks says it has found no impact so far on Inference, the Training SDK or Nexus, which are zero data retention by default, but stresses that the finding is based on its investigation to date and that the investigation is continuing. It has disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training while the investigation continues.

LLMJacking and the wider pattern

Fireworks says the evidence links the activity to a financially motivated cybercriminal group aiming to sell unauthorised access to large language models through illicit routing gateways, an activity known as LLMJacking. Google Threat Intelligence Group and Mandiant published research on 2 November describing how such illicit gateways, called LLM Mixers, proxy and resell stolen model access.

The company says it has notified law enforcement and brought in Palo Alto Networks Unit 42 for forensic analysis. Its response has included revoking and replacing credentials and service accounts, removing unnecessary elevated privileges, isolating affected systems and tightening access to data storage.

Forbes reported that two customers had already substantially moved their business off Fireworks’ systems after the incidents. The breach is one of at least nine security incidents disclosed by AI developer platforms in October 2026, according to research by Wiz published on 30 October, most of them involving targeted hunting for stored credentials that grant access to AI models.

Source: Fireworks AI security bulletin