Fireworks AI told customers on Monday that the October break-in was worse than it first admitted. Hackers reached billing records across the company’s customer base and, for a limited set of accounts, got into training datasets and unfinished model weights, the raw material companies pay Fireworks to run and fine-tune.
The company, valued at $17.5 billion in July and used by roughly 10,000 businesses including Uber, Shopify, Cursor, and Notion, first described the incident on October 9 as a credential leak.
Five weeks later, that description doesn’t hold.
What the Fireworks AI breach exposed
Fireworks’ November 9 update lists three kinds of data the attackers reached through an internal application. First, resource metadata: identifiers, display names, descriptions, and creation times for customer resources. Second, billing information: billing and shipping addresses, invoice and payment history, account balances, and credit usage. Third, and the part that changed the story, a subset of incomplete model weights and datasets for certain customers, plus stored secrets.
Payment card numbers were not part of it. Fireworks says it doesn’t store them, so there was nothing to steal. The company also says it has found no impact so far on Inference, its Training SDK, or Nexus, the services it describes as zero data retention by default. That finding is provisional. Fireworks stresses the investigation is ongoing and could turn up more.
How the attackers got in — twice
Fireworks found the first intrusion on October 6, when someone used the company’s own internal credentials to read environment variables stored in evaluation jobs. The October 9 bulletin said API keys and tokens stored as secrets were probably captured, and told affected customers to rotate them. It also said there was no evidence customer models, datasets, or training data had been touched. That part turned out to be wrong — or at least premature.
The second way in came from outside. A third-party cloud provider hosting Fireworks’ research and development machines had its own security incident on October 23. The next day, the intruder used that opening to reach Fireworks’ development machines and run an unauthorized workload. Fireworks says it spotted the activity the same day and has seen no further successful access on the customer platform since October 25.
Fireworks hasn’t named the cloud provider. It has notified law enforcement and brought in Palo Alto Networks’ Unit 42 for forensic analysis. It has also switched off self-serve dataset uploads and downloads used by Batch Inference and dataset-based training while the investigation continues.
Why unfinished weights still matter
A half-trained model sounds like a consolation prize. It isn’t, exactly. Model weights, even incomplete ones, carry the structure of the model a customer paid to build, and datasets can hold the training data itself. For companies fine-tuning open models on their own data, that’s the most valuable thing they own, sitting on someone else’s servers.
Fireworks hasn’t said how many customers lost weights or datasets, or how much data was involved. It says it’s notifying affected customers with account-specific details and recommended steps. Customers who got no notice, it says, haven’t been identified as affected.
What the attackers wanted
Fireworks says the evidence points to a financially motivated criminal group, not a state actor or a rival. The scheme has a name: LLMjacking. The idea is simple: steal access to large language models, then resell it cheap through illicit routing gateways to buyers who don’t want to pay full price.
Google’s Threat Intelligence Group and Mandiant described the trade in research published November 2, calling the middlemen “LLM Mixers”: services that proxy, aggregate, and resell unauthorized model access to underground subscribers. Fireworks cited that research in its own update.
Customers are already leaving
Some customers aren’t waiting for the final report. Forbes reported November 9 that two customers had already moved most of their business off Fireworks’ systems. One of them described a series of “very bad hacks” and poor communication from the company. Two other customers Forbes spoke to said they didn’t know about the breach at all.
Notion, one of Fireworks’ best-known customers, disclosed on November 10 that it was affected by the breach. Bloomberg called the November 9 notice the Nvidia-backed company’s second hack disclosure in a matter of weeks.
There’s no sign of a mass exodus yet. Fireworks serves more than 10,000 customers, and moving AI workloads isn’t like switching email providers. The capacity to run that traffic elsewhere is scarce, and the models are tuned to Fireworks’ stack.
Why this matters
The breach lands at an awkward moment for the AI infrastructure business. Fireworks said in July it had reached $1 billion in annual revenue, and the whole pitch of companies like it is that enterprises can hand over their most valuable AI assets — their data, their fine-tuned models, and trust the plumbing. Two intrusions in five weeks, one of them through a vendor Fireworks doesn’t even name, test that trust in a way a price cut can’t fix.
There’s a second lesson here, and it’s about disclosure. Fireworks’ October bulletin said no customer models or datasets had been touched. Five weeks later, the company says the opposite. The October statement may have been honest at the time. The company says it found the wider impact later, but customers who made decisions based on it now have to redo that math. In security, the first version of the story is rarely the last, and the gap between the two is where trust gets lost.
FAQ
What happened in the Fireworks AI breach?
On November 9, 2026, Fireworks AI said hackers reached customer billing records and, for a limited set of accounts, datasets and unfinished model weights. It was the second disclosure tied to an October intrusion the company first described as a credential leak.
Were payment card numbers stolen in the Fireworks AI breach?
No. Fireworks says it does not store payment card numbers, so they were not affected. The exposed billing data covered addresses, invoices, payment history, account balances, and credit usage.
What is LLMjacking?
LLMjacking is the sale of stolen access to large language models through illicit routing gateways. Fireworks said evidence links its breach to a financially motivated group using that scheme, which Google’s Threat Intelligence Group described in research published November 2.
Did Fireworks AI customers leave after the breach?
Two customers told Forbes they had already moved most of their business off Fireworks, while two others said they did not know about the breach. Notion disclosed on November 10 that it was affected.
Sources: Forbes, Bloomberg, Fireworks AI security bulletin, Google Threat Intelligence Group and Mandiant, Unite.AI