- A third-party cloud provider hosting Fireworks R&D machines was breached on October 23, and the next day the intruder used that access to reach Fireworks development machines and run an unauthorized workload.
- Billing addresses, invoices, balances and resource metadata were exposed, plus datasets and incomplete model weights for some customers; payment card numbers are not stored and inference traffic shows no impact so far.
- Fireworks links the attack to a financially motivated group that resells stolen model access, a practice Google's Mandiant says has produced fraudulent charges above $100,000 in a single day.
Fireworks AI, the inference and fine-tuning platform valued at $17.5 billion in July, told customers on November 9 that an intruder who came in through a breached cloud provider reached its billing records and, for a limited set of accounts, stored datasets and incomplete model weights, widening an incident the company first disclosed a month earlier as a leak of stored secrets.
Fireworks traced a second intrusion to a breached cloud provider
The first bulletin, published October 9, described attackers using internal Fireworks credentials to read environment variables in evaluation jobs, which exposed customer API keys stored as secrets. The November 9 update adds a separate route. According to the Fireworks security bulletin, a provider hosting the company's research machines was compromised on October 23, and on October 24 the intruder pivoted into Fireworks development systems. Chief executive Lin Qiao wrote that the attacker then escalated permissions across multiple hops to assume a cloud service account with access to a subset of storage.
| Resource metadata | Identifiers, display names, descriptions and creation times |
| Billing information | Billing and shipping addresses, invoice and payment history, account balance and credit usage; card numbers are not stored |
| Model weights and datasets | A subset of incomplete model weights and datasets, for certain customers |
| Products with no detected impact | Inference, Training SDK and Nexus, all zero data retention by default |
“For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models.”
Fireworks AI, Update on October 2026 security incident, November 9, 2026
Stolen model access is now worth more to attackers than stolen data
Fireworks says the evidence points to a group that sells tokens from hijacked large language model access through illicit routing gateways, known as LLMJacking. Google Threat Intelligence Group and Mandiant described the same economy on November 2, reporting single-day fraudulent charges above $100,000 in incidents they handled. The company has disabled self-serve dataset uploads and downloads for batch inference and dataset-based fine-tuning while Palo Alto Networks Unit 42 continues the forensic work.
The exposure lands on the part of the business Fireworks has sold hardest. When it raised its $1.5 billion Series D, the company said 95% of the tokens it served came from specialized models, the kind customers build on their own data. Partial weights and training sets for those models are the assets a customer cannot rotate like an API key, and that makes the November 9 disclosure a harder conversation for every specialized-model host than a credential leak ever was. Today's other Santage story looks at a frontier lab hardening its own models against copying: Anthropic's Fable 5.2 launch.
Santage is committed to independent, transparent journalism. This article is produced in accordance with Santage's Editorial Standards and aims to provide accurate and timely information. Readers are encouraged to verify information independently.