Fireworks AI Hit by Second Breach in October, Customer Billing Data and Model Weights Exposed

Fireworks AI Discloses Expanded Data Breach Impact

Fireworks AI has disclosed a second security incident in October 2026 that significantly expands the scope of customer data exposure beyond what the company initially reported. The AI infrastructure provider revealed on Monday that attackers accessed customer billing data, incomplete model weights, and datasets after compromising a third-party cloud provider hosting its research and development machines1

1

2

2

. The breach affects the platform that lets customers train and run AI models including Mistral, Meta's Llama, and Google's Gemma.

The company grouped the affected information into three categories: resource metadata including Fireworks resource identifiers, display names, descriptions, and creation times; customer billing data encompassing billing and shipping addresses, invoice and payment histories, account balances, and credit usages; and a subset of incomplete model weights and datasets for certain customers3

3

. Payment card numbers remained unaffected as Fireworks AI does not store this information.

Third-Party Cloud Provider Hack Enables Development Systems Access

The October 23 breach occurred when attackers compromised an unnamed third-party cloud provider hosting Fireworks AI's research and development machines. The following day, on October 24, the unauthorized third party leveraged this access to reach Fireworks development systems and execute unauthorized workloads2

2

3

3

. The company detected the suspicious activity on the same day and immediately activated incident response protocols.

This incident marks the second security breach Fireworks AI experienced in October. The company first disclosed an incident on October 9 after detecting unauthorized use of internal credentials on October 6 at 9 a.m. PDT. In that initial breach, attackers accessed environment variables in evaluation jobs, including API keys and tokens belonging to some customers1

1

. At the time, Fireworks AI stated it found no evidence of access to models, datasets, training data, inference traffic, or personal information—a statement that Monday's update substantially contradicts.

LLMjacking Operations Target Large Language Models

Fireworks AI suspects the attacks link to a financially motivated cybercriminal group involved in LLMjacking—an emerging threat where attackers sell unauthorized access to large language models through illicit gateways2

2

3

3

. Lin Qiao, Fireworks co-founder and CEO, clarified that stealing model weights did not appear to be the primary motive. "From what we see attackers are not after weights," Qiao stated. "Most downloads were partial and stopped"1

1

.

LLMjacking refers to hijacking a victim's large language models through compromised credentials to fuel criminal enterprises that profit from selling access to other threat actors while leaving legitimate owners to pay inflated cloud AI charges. Last week, Google's Threat Intelligence Group warned that LLMjacking attacks are driving record costs for compromised organizations, with fraudulent cloud AI charges reaching as high as $1 million in some cases2

2

.

Customer Data Exposure Affects Notion, Cursor, and Harvey Users

Render founder and CEO Anurag Goel shared a notification from Notion warning that some chats with its AI assistant may have been exposed through the Fireworks AI incident. Notion informed affected workspaces that they were among the less than 1 percent of workspaces potentially impacted1

1

. "Some unattributable chat sessions with Notion AI may have been exposed in this incident," the notification stated. While Notion emphasized that exposed transcripts lacked separate information linking them to particular users or workspaces, Reddit users pointed out that conversations themselves could contain identifying details.

Bloomberg reports that Fireworks AI is working with additional customers including Cursor and Harvey to assess the full impact of the customer data exposure1

1

. The company has not disclosed the total number of customers affected by either of the two October attacks.

Security Hardening and Incident Response Measures

Following detection of the unauthorized workloads, Fireworks AI partnered with Palo Alto Networks Unit 42 incident response division to remediate the attack and investigate its full scope1

1

2

2

. The company implemented multiple security measures including rotating compromised credentials and service accounts, isolating affected systems from the network, restricting unauthorized network pathways, and tightening access controls to data storage and analytics systems to block public or unauthorized access3

3

.

As of October 25, Fireworks AI reported no further evidence of successful unauthorized access by the threat actor on the platform customers use3

3

. The company has also improved its logging and monitoring systems to detect future intrusion attempts. Watch for potential ripple effects across the AI infrastructure sector as organizations reassess third-party cloud provider security and implement stricter access controls to prevent similar LLMjacking operations targeting development systems.