Fireworks AI, which hosts AI models for developers to call over an API, has told customers that the intruders in its October breach reached much further than first reported. In a bulletin updating its 9 October notice, the company says account and billing details were exposed, and that a limited set of accounts also had secrets, datasets, and unfinished models exposed.
The first notice was narrower. At that point, Fireworks knew of access only to its own stored secrets, such as the ones used in evaluation jobs. Everything beyond that came out of the forensic work the company started with the security firm Unit 42 (part of Palo Alto Networks) after notifying law enforcement.
The evidence points to a criminal group that steals access to large language models and sells it on to illicit routing gateways, a practice known as LLMJacking. Fireworks says the group is financially motivated and that it sells tokens obtained through unauthorized access. The company cites a 2 November blog post on the rise of the practice from Mandiant and Google’s threat intelligence team. The business logic is simple enough: a stolen credential lets a buyer run models while someone else gets the invoice.
The bulletin lays out a chain of events. On 23 October, an outside cloud company that housed Fireworks research machines suffered its own security incident. The next day, the unauthorized party used that foothold to get onto Fireworks development machines and ran a workload nobody had approved, which caused further customer data impact. Fireworks says it spotted the activity the same day and closed the critical holes it knew about. As of 25 October, it had found no further successful access to the platform customers use.
Fireworks lists three categories of information that the affected internal application could reach:
- Resource metadata, including identifiers, display names, descriptions, and creation times.
- Billing records: billing and shipping addresses, past invoices and payments, the account balance, and how many credits were used.
- Model weights and datasets, but only partial ones and only for some customers.
Fireworks says it never stores card numbers, so none were exposed.
Fireworks also says it found no impact on Inference, Training SDK, or Nexus, all of which keep zero data at rest by default. For anyone sending prompts to hosted models, that is the line that matters most. It rests on the investigation so far, and Fireworks says that investigation is ongoing and may turn up more.
The cleanup so far is substantial. It rotated credentials and service accounts, stripped unneeded elevated privileges, isolated affected systems, tightened access to its storage and analytics systems, and strengthened logging. While it investigates, it has also switched off customers’ own dataset uploads and downloads, the route that Batch Inference and training on uploaded datasets rely on. The Training SDK stays up, and Fireworks Lab training runs in an isolated environment.
Customers whose data was touched are being notified by email, with details of the impact and recommended steps. Fireworks has not said how many accounts fall into the limited set, and it has given no date for the return of dataset uploads, so a team that runs batch jobs or fine-tuning there is planning around a gap with no end date.
Reported by Fireworks AI in its security bulletin “Update on October 2026 security incident”, which carries no publication date.
