Fireworks AI says its October breach reached billing data and, for some accounts, secrets, datasets and incomplete model weights

Fireworks AI updated its security bulletin on November 9, 2026. That page says it was last updated November 9, 2026. It says this is an update to the bulletin published on October 9, 2026. The first bulletin's page says it was last updated October 10, 2026, 11:16 PDT.

The November 9 update says that when the first bulletin was published, only Fireworks stored secrets, for example those used in evaluation jobs, were known to have been accessed. It says Fireworks has since found impact to account and billing information and, for a limited set of accounts, impact to secrets, datasets and incomplete models.

What the first bulletin reported

In the first bulletin, Fireworks said that on October 6 it identified unauthorized use of internal Fireworks credentials. An unauthorized third party accessed environment variables used in evaluation jobs in a limited number of customer accounts. Fireworks says it believes environment variables, including API keys and tokens stored as secrets, were captured in certain affected accounts. At that time it said it had not detected evidence of unauthorized access to customer models, datasets, training data, personal information, or inference traffic within the Fireworks security perimeter. Its timeline, in PDT, says it identified the activity and began containment on October 6 at 9am, started notifying affected customers on October 7 at 7am, and published the bulletin on October 9 at 10pm. It says it revoked identified internal credentials used in the incident, affected Fireworks API keys, and keys identified as created by the attacker.

What the November 9 update adds

Fireworks says a third-party cloud provider that hosted Fireworks research and development machines had a security incident on October 23. On October 24 the unauthorized party used it to reach Fireworks development machines and run an unauthorized workload that led to more customer data impact. Fireworks says it detected that activity the same day and has not detected further successful unauthorized access, as of October 25, on the Fireworks platform customers use. The update does not name the cloud provider.

The update says the affected internal application could reach these categories: resource metadata, such as Fireworks resource identifiers, display names, descriptions and creation time; billing information, such as billing and shipping addresses, invoice and payment history, account balance and credit usage; and, for certain customers, a subset of incomplete model weights and datasets that were accessed. Fireworks says it does not store payment card numbers and they were not affected. It says it has not detected any impact to Inference, Training SDK or Nexus, which are zero data retention by default. It says these findings are based on the investigation so far, the investigation is ongoing, and it may show more.

Fireworks says the evidence indicates links to a financially motivated group aimed at selling tokens from unauthorized access to large language models to illicit routing gateways, known as LLMJacking. It says that on November 2, Google Threat Intelligence Group and Mandiant published a post about LLMJacking. The update does not name the group. Fireworks says it notified law enforcement and is working with Palo Alto Networks Unit 42. It has disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training while it investigates. It says Training SDK remains available with zero data retention, meaning no training data stored at rest.

What Fireworks tells affected customers

Fireworks says it is notifying customers whose data was affected and giving them details and recommended actions. The first bulletin tells affected customers to replace revoked Fireworks API keys if they still need them, rotate or revoke the third-party credentials named in their notice with the providers that issued them, review those providers' logs for unauthorized reads, downloads or changes, and check the account for API keys, users, evaluators, training jobs and datasets they do not recognize. It says: "Removing a stored secret alone does not invalidate the underlying credential." The first bulletin says that if you have not received an affected-customer notice, no incident-specific action is currently required. The November 9 update does not repeat that sentence. It says Fireworks is notifying customers whose data was affected.

Notion AI chat transcripts

Notion's advisory, updated November 10, 2026, says the Fireworks incident is impacting fewer than 1% of Notion workspaces. Notion says the final dataset Fireworks confirmed on November 8 included some Notion AI chat transcripts used for Notion's Insights feature. Notion says it contacted affected customers on November 9. Notion says that if it contacted you and you pasted passwords, API keys, or other credentials into Notion AI during the incident timeframe, rotate them. For third-party credentials named in Fireworks's affected-customer notice, Fireworks's original bulletin says to rotate or revoke them with the providers that issued them. Notion AI chats in Fireworks breach: what to do has Notion's timeline and the unattributable-transcript caveat.