Fireworks AI widens breach disclosure to customer datasets and partial model weights

AI inference and fine-tuning platform Fireworks AI on November 9 expanded its disclosure of an October security incident, acknowledging that hackers reached more customer data than first reported. The company said attackers accessed account and billing information, and for some customers, datasets and a subset of incomplete model weights; the incident involved two intrusion paths, including one through a third-party cloud provider that hosted the company's research and development machines. The company has notified law enforcement and brought in Palo Alto Networks' Unit 42 for forensic support. (Photo: data centre network security illustration. Photo: 3DVF.)

Two intrusion paths

Fireworks first disclosed in a security bulletin on October 9 that on October 6 it had detected unauthorised use of internal credentials to access environment variables used in evaluation jobs in a limited number of customer accounts. At that stage the company said it had not detected unauthorised access to customer models, datasets, training data, personal information or inference traffic. The updated investigation found a second path that began outside Fireworks: on October 23, a third-party cloud provider hosting Fireworks research and development machines experienced a security incident; the next day, the intruder used that opening to reach Fireworks development machines and run an unauthorised workload, leading to further customer-data exposure. The company said it detected the activity the same day and took remediation measures, closing known critical vulnerabilities; as of October 25, it had not detected further successful access by the actor on the customer platform.

What was exposed

According to the updated security bulletin, the affected internal application provided access to resource metadata including identifiers, display names, descriptions and creation times; billing information included billing and shipping addresses, invoice and payment history, account balances and credit usage. The company stressed that it does not store payment card numbers, which were unaffected. For certain customers, attackers also accessed secrets, datasets and a subset of incomplete model weights — the numerical values that make up a model. Fireworks said it has detected no impact to Inference, Training SDK or Nexus, which operate with zero data retention by default; the investigation is ongoing and findings may change. Affected customers are receiving account-specific details and recommended responses.

Linked to a group selling illicit model access

Fireworks said evidence points to a financially motivated cybercriminal group aiming to sell unauthorised access to large language models through illicit routing gateways, an activity known as "LLMJacking". Research published on November 2 by Google's Threat Intelligence Group and Mandiant also described the rise of this activity. Bloomberg characterised the November 9 notification as the company's second hack disclosure in a matter of weeks. The company says it serves more than 10,000 customers; Forbes reported that two customers said they had already substantially moved their business off Fireworks' systems. During the investigation, Fireworks has disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training.