Fireworks AI says attackers reached model weights via cloud provider breach

Summary

• A third-party cloud breach let intruders into Fireworks AI development machines on October 24, the company said.
• Metadata, billing records and, for a limited set of accounts, secrets, datasets and incomplete model weights were accessed.
• Evidence ties the activity to a financially motivated group reselling unauthorized access to large language models.

The latest

Unauthorized access to Fireworks AI development machines began with a security incident at an external cloud provider hosting the company's research and development hardware, according to a November 9, 2026 security bulletin. The intruder ran an unauthorized workload the next day, causing additional impact to customer data. Fireworks lists the incident status as active monitoring and says it has notified law enforcement.

Details

• The timeline: Fireworks published its first security statement on October 9, according to the bulletin. On October 23 an external cloud provider hosting the company's research and development machines was breached, and on October 24 an unauthorized party used that access to enter Fireworks development machines and run an unauthorized workload, which the company says it detected the same day.
• What was accessed: The bulletin lists resource metadata including identifiers, display names, descriptions and creation times, plus billing information covering billing and shipping addresses, invoice and payment history, account balance and credit usage. For a limited set of accounts, secrets, datasets and incomplete model weights were also reached.
• What was spared: Fireworks states payment card numbers are not stored on its systems and were not affected, and that its Inference, Training SDK and Nexus services were not impacted because they operate under zero data retention by default. On October 25 it reported no further evidence of successful unauthorized access to the customer-facing platform.
• The response: Per the bulletin, Fireworks revoked and rotated credentials and service accounts, removed unnecessary elevated permissions, tightened controls on creating new credentials, restricted unauthorized network paths and isolated affected systems. It also reviewed access to data storage and analytics systems and strengthened logging and monitoring.
• Services suspended: The company disabled self-service dataset upload and download for Batch Inference and dataset-based training while the investigation continues. The Training SDK remains available in zero data retention mode, and Fireworks Lab training runs in an isolated environment. No date is set for restoring the suspended functions.
• The investigation: Unit 42, part of Palo Alto Networks, is conducting forensic analysis and security hardening. Fireworks says evidence links the activity to a financially motivated criminal group that sells unauthorized access to large language models, a pattern known as LLMJacking. Google Threat Intelligence Group and Mandiant published a post on the technique on November 2.
• Customer notification: Affected customers are being contacted directly and given recommended response actions in notification messages, the company says. The bulletin does not state how many customers were affected or name any of them.
• The commercial stakes: Forbes reported on November 9, in a piece by Anna Tong and Rashi Shrivastava, that Fireworks AI is valued at 17.5 billion dollars and serves roughly 10,000 enterprise customers including Uber, Shopify, Upwork, DoorDash, Cursor and Cognition. An earlier Forbes report put 2025 revenue near 250 million dollars.
• Customer reaction: An unnamed customer told Forbes the run of breaches was "really bad" and accelerating, and criticized the company's communication with clients. Forbes reported that two customers have largely moved off Fireworks, while two others said they were unaware of any breach.
• The CEO's account: Chief executive Lin Qiao said in a post on X that attacker behavior suggested the intrusion appeared to involve AI agents, according to Forbes' characterization of her remarks.

Between the lines

The entry point was not Fireworks itself but a cloud provider hosting its development hardware, which means an enterprise contracting with Fireworks absorbed exposure from a vendor it never signed with. The assets reached in a limited set of accounts — secrets, datasets and incomplete model weights — are the components a company would least expect to sit outside its own perimeter.

What's next

Watch for Unit 42's forensic findings, the restoration of self-service dataset upload and download for Batch Inference, any disclosure of the number of affected customers, and whether the incident status moves off active monitoring.

Source: Fireworks AI security bulletin, Forbes