Fireworks AI's Breach Disclosure Grew to Include Model Weights

TL;DR

Fireworks AI, an AI inference platform, now says attackers reached customer datasets and incomplete model weights, a month after telling the public that its October breach had touched neither. Two separate intrusions are involved: credential misuse detected on October 6 that exposed API keys in evaluation-job environment variables, and a compromise of a third-party cloud provider on October 23 that gave attackers a route into Fireworks development machines the next day. Downstream customers Notion, Cursor and Harvey are named as affected, with Notion AI chat transcripts among the exposed data. CEO Lin Qiao says the attackers were “not after weights” and that “most downloads were partial and stopped.” If you build on an inference provider, the lesson is that your sub-processor’s R&D environment is part of your attack surface.

The route to Notion’s AI chat transcripts ran through somebody else’s cloud account. A third-party provider hosting Fireworks AI’s R&D and development infrastructure was compromised on October 23. The Register reports that attackers used that foothold the next day to reach Fireworks development machines and run unauthorized workloads of their own.

Fireworks says it has detected no further successful unauthorized access since October 25, 16 days ago. Palo Alto Networks’ Unit 42 has been engaged for the incident response, according to one report.

Two intrusions, two vectors

Fireworks describes this as its second incident of the month, with a different entry point from the first. That distinction got lost in the announcements, and readers on Hacker News came away asking whether this was simply the October breach that never got closed. The question is fair given how the two disclosures read side by side.

The first incident Fireworks detected on October 6: unauthorized use of internal credentials, which exposed API keys and tokens sitting in the environment variables of evaluation jobs. The company’s own security bulletin covers that one, and customer notification began the following day. The October 23 cloud-provider compromise is the one that widened the blast radius into billing records, account and resource metadata, customer datasets and partial model weights.

Whether the same actor ran both operations is unconfirmed. Fireworks has not said so, and no source reviewed establishes it.

LLMjacking, not espionage

Attribution points to a financially motivated cybercrime group rather than a state actor. The business model has a name: LLMjacking, where stolen API credentials get resold as discounted inference access, sometimes through intermediaries that mix traffic across many hijacked accounts. The Neuron’s writeup of the breach cites Google research on earlier, unrelated cases where fraudulent usage on stolen accounts passed $1 million in a single day.

That framing matters for how you read the weights exposure. Qiao’s position is that the intruders wanted resellable compute, and that the model downloads they did start were incomplete and interrupted. A set of truncated weight files is a weaker prize than a clean copy of a customer’s fine-tuned model.

It is also the company’s characterisation of its own incident, offered without a published count of affected accounts. Fireworks, The Register and BleepingComputer all say “a limited number of accounts” and stop there. Partial weights from an interrupted download are still customer IP that left the building, and “most” downloads being partial leaves the remainder unaccounted for.

The customers who never signed a contract with Fireworks

Notion, Cursor and Harvey appear in coverage as affected customers. The people whose data sat in Fireworks’ systems were using those products, with no relationship to Fireworks and, in most cases, no idea the dependency existed. Notion AI chat transcripts, collected for its Insights feature, are among the exposed data.

Notion’s response is that fewer than 1% of its workspaces were affected and that the exposed chat data is “unattributable,” lacking the metadata that would tie a conversation back to a specific workspace, user or company. Critics on Hacker News pushed back that the conversation contents remain exposed regardless of attribution metadata, a real tension between the company’s risk framing and the practical harm to users, though an unverified one. Chat logs from a knowledge-base tool do tend to carry self-identifying material inside the text.

Payment card numbers were not exposed, since Fireworks does not store them. That is the one piece of good news that holds up without qualification.

Warning

If you resell or embed a third-party inference API, your customers’ data inherits that provider’s R&D environment as part of its threat model. Fireworks’ development infrastructure sat with a cloud provider that got compromised, and that was enough to reach billing records and customer datasets. Ask your provider where dev and eval workloads run, and what customer data is reachable from them.

What’s still missing

No affected-account figure has been published for either incident. A “10,000+ users” number circulating on aggregator sites does not trace to Fireworks or to any mainstream outlet, and should be treated as unsourced. Cursor and Harvey have issued no public statements beyond being named. The only account of whether affected users were individually notified comes from a Hacker News commenter who said they received nothing, worth flagging as an unverified claim rather than a confirmed gap in Fireworks’ process.

The reporting standard here deserves attention too. On October 9, Fireworks said it had detected no access to customer models, datasets, training data, personal information or inference traffic. A month later that statement covers datasets and incomplete weights, and a revision on that scale costs a vendor more trust than a slower, wider initial disclosure would have.

Sources: Fireworks October 2026 security incident bulletin • The Register: Fireworks AI gets burned twice • BleepingComputer: Fireworks AI discloses new breach after cloud provider hack

Coverage: The Hacker News: Fireworks AI confirms wider breach • The Neuron: How criminals profit from stolen AI • Hacker News discussion