Fireworks AI Breach Widens: Billing Data, Datasets and Weights Exposed

Fireworks AI first told customers about a security incident on October 9, 2026, and the news then was narrow: someone had misused internal credentials and reached secrets stored for evaluation jobs in a small number of accounts. A month later, the story is wider. On November 9, the company published an update saying its investigation had found impact to account and billing information, and, for a limited set of accounts, to secrets, datasets and incomplete model weights. The October bulletin had said there was no evidence of access to customer models or datasets. That line no longer holds.

The update also adds a second way in. On October 23, a third-party cloud provider that hosted Fireworks research-and-development machines had a security incident of its own. The next day, the intruder used that opening to reach Fireworks development machines and run an unauthorized workload. Fireworks says it detected the activity the same day and closed the known critical vulnerabilities, and that as of October 25 it had found no further evidence of successful unauthorized access on the platform customers use.

Fireworks is an inference and fine-tuning platform for open-weight models, and it says it serves more than 10,000 customers. Bloomberg Law described the disclosure as the company's second known hack in a matter of weeks, and, according to Silicon Report's account of the Bloomberg Law reporting, Fireworks is working with affected customers including Notion and Cursor. The company has not published a count of affected customers or keys, and its investigation is still open, so the numbers in this article are the ones Fireworks and the researchers tracking the incident have actually published, with the gaps stated plainly.

What changed on November 9

The original bulletin, published October 9, described one intrusion. On October 6, Fireworks found unauthorized use of internal credentials. An unauthorized party had accessed environment variables used in evaluation jobs in a limited number of customer accounts, and Fireworks believed environment variables, including API keys and tokens stored as secrets, had been captured in certain affected accounts. At that point the company said it had found no evidence of unauthorized access to customer models, datasets, training data, personal information or inference traffic, and it pointed to its zero data retention design: Fireworks does not store prompts or outputs by default.

The November 9 update revises that picture in two ways. First, the scope of what was reached is larger. The affected internal application gave access to resource metadata such as identifiers, display names, descriptions and creation times; billing information such as billing and shipping addresses, invoice and payment history, account balances and credit usage; and, for certain customers, a subset of incomplete model weights and datasets. Second, there was a second path. The October 23 incident at the third-party cloud provider gave the intruder a route into Fireworks development machines on October 24, and that route produced additional customer data impact.

Two things the update does not change. Fireworks says payment card numbers are not stored by the company and were not impacted. And it says it has not detected any impact to Inference, the Training SDK or Nexus, which are all zero data retention by default. Both findings are qualified in the bulletin itself: they are based on the investigation to date, and the investigation is ongoing and may reveal more.

The two intrusions, on a timeline

Fireworks has not said whether the same people ran both paths. The bulletin links the activity to a financially motivated cybercriminal group aiming to sell tokens from unauthorized access to large language models through illicit routing gateways, a practice known as LLMJacking. It does not name the third-party cloud provider, and it does not describe the vulnerabilities involved.

What was taken, and what was not

The clearest way to read the update is as three buckets. The first is account and billing information, which Fireworks says was impacted across the affected accounts. That covers billing and shipping addresses, invoice and payment history, account balances and credit usage, plus resource metadata such as identifiers and creation times. The second bucket is narrower: for a limited set of accounts, secrets, datasets and a subset of incomplete model weights were accessed. The word incomplete matters here. Fireworks describes the weights as a subset of incomplete models, which is not the same as a finished production model walking out the door, and the company has not said whose weights they were or how complete the subset was.

The third bucket is what Fireworks says it has not found. No impact has been detected on Inference, the Training SDK or Nexus, all of which run with zero data retention by default. No payment card numbers were involved, because Fireworks does not store them. And the company has not said that customer prompts or inference traffic were leaked. None of those findings is final. The bulletin repeats that the investigation is ongoing, and the October bulletin used the same "based on our investigation at this time" wording before the scope grew.

Customers who have not received a notice have, so far, not been identified as affected. The October bulletin said exactly that, and the update repeats that Fireworks is notifying the customers whose data was impacted with details and recommended actions. If that changes, the company says it will contact customers directly.

Why attackers wanted Fireworks keys: LLMJacking

The motive Fireworks names is not data theft for its own sake. It is resale. Stolen access to paid language models can be sold on, and a week before Fireworks expanded its disclosure, Google Threat Intelligence Group and Mandiant published a report explaining how that market works. Mandiant responded to multiple LLMJacking incidents in 2026 across North America, South America and Asia Pacific, in financial services, retail, technology and transportation. In individual incidents, the researchers observed fraudulent charges above $100,000 in a single day, with cumulative charges at some organizations reaching $1 million before access was revoked.

At November 10, 2026 market rates (1 USD = 0.744 GBP, 1.412 CAD), $100,000 is about £74,400 or C$141,200, and $1 million is about £744,000 or C$1,412,000. Those are approximations; the dollar figures are the ones the researchers published.

The report describes a division of labor. One set of actors establishes initial access, often through stolen cloud identity credentials, service account keys or API keys harvested from public repositories. Another set runs the monetization infrastructure, called LLM Mixers: illicit routing gateways that proxy, aggregate and resell the stolen access to underground subscribers. In one investigation, Google observed two distinct operational clusters coordinating to compromise and monetize the same enterprise infrastructure.

The best-documented example in the report is a service called Jet Night. It ran more than 500,000 model calls in under eight hours on stolen keys, passing nearly $1 million in token costs to the victim organization, according to Google. Jet Night offered an unlimited token plan for about $60 a month with claimed access to frontier models, a service level Google estimates would typically cost $100 to $250 a month through legitimate channels. Google's conclusion is blunt: given Jet Night's per-token costs to users are so far below typical market rates, it believes the service relies on stolen keys to operate profitably.

Fireworks fits this pattern directly. Its platform holds the keys that grant access to paid models, and its pricing shows how fast a hijacked key can burn. DeepSeek V4.1 Flash costs $0.30 per million input tokens and $1.20 per million output tokens on Fireworks' standard tier, Kimi K3 costs $3.00 in and $15.00 out, and GLM 5.3 costs $1.40 in and $4.40 out, all read from Fireworks' own pricing page on November 10. At those rates, $100,000 buys roughly 333 billion input tokens of DeepSeek V4.1 Flash, or about 83 billion output tokens. That is our arithmetic on the published rates, not a figure Fireworks published, but it shows why a stolen key is worth reselling rather than sitting on.

The wider pattern: nine platforms in one month

Fireworks was not an isolated case. On October 30, cloud security company Wiz published a roundup it called "Black October," counting at least nine AI developer platforms that disclosed security incidents during the month. The list runs from Fireworks on October 6 through Northflank on October 30, and Wiz has since added more names in updates, including Brev, Trigger.dev, Chainstack, kernel.sh, Blacksmith and Tensorlake. The full nine are Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank.

Wiz is careful about what the pattern does and does not prove. All public reports highlight targeted exploitation hunting stored environment variables, with a focus on keys that grant AI access, but there is no single vulnerability or dependency linking the attacks, and no company or researcher has tied them to one attacker. Root causes differ: Fireworks, Zeabur and Lightning attribute theirs to credential access, Railway points to privilege escalation in its build infrastructure, Warp suggests a third-party vendor dependency, and OpenCode attributes its incident to a legacy system. Zeabur shared the fullest write-up of the nine, and it is shutting down on December 31, 2026 as a result of its breach.

What Wiz could trace is what happened after the keys left. In two enterprise cases it could attribute to one of the vendor breaches, the first unauthorized use came within 30 minutes of the reported credential access: a single test call from a residential IP address, asking for Claude Fable 5.1, failing, and falling back to Opus 5.5, which worked. In the first case, the key then ran about 800,000 Amazon Bedrock calls over 30 hours, with about 90 percent succeeding, most of them on Opus models. In the second, a single address made about 1.7 million Bedrock calls over 13 hours, with more than a million succeeding. Wiz estimates the two cases together likely ran up more than $100,000 in usage at list prices. That is an estimate at list prices, not a confirmed bill, and Wiz does not say which vendor's breach produced either key.

Wiz also notes anecdotal reports on social media of about $371,000 in cryptocurrency stolen using keys stored in Railway. That figure is unconfirmed, and Wiz presents it as a social media report, not as its own finding. The same caution applies to the reseller infrastructure Wiz describes: it identified two resale operations with access to the stolen keys, but says it cannot definitively tie either one to the initial compromises or to the flood of abuse that followed.

What Fireworks has done so far

Fireworks says it notified law enforcement and brought in Palo Alto Networks Unit 42 for forensic analysis. Working with Unit 42, it revoked and replaced credentials and service accounts, removed unnecessary elevated privileges, restricted unauthorized network pathways, isolated affected systems, tightened access to data storage and analytics systems, and secured and enhanced its logging and monitoring.

One operational change affects customers directly. Fireworks has disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training while the investigation continues. The Training SDK remains available with zero data retention, meaning no training data stored at rest, and training through Fireworks Lab runs in an isolated environment with additional network and storage protection. The company says it will keep monitoring around the clock and publish further updates as appropriate.

There is also a pricing detail worth knowing if you are sizing the exposure. Fireworks bills serverless inference per token with no monthly subscription: under-4B models run about $0.10 per million tokens, 4B to 16B models about $0.20, and models over 16B about $0.90, with batch inference at 50 percent of the serverless rate and cached input at half price or less. Dedicated GPUs start at $8.00 an hour for an H100, and new accounts start with $1 in credit, according to an October 29 pricing comparison that read Fireworks' pricing page. The point for this story is not the price list itself. It is that a key with no spend cap can convert a quiet account into a five- or six-figure bill in hours, which is exactly what the Wiz and Mandiant cases show.

What customers should do now

Fireworks' own bulletin gives affected customers four steps, and they are worth following in order. First, replace any revoked Fireworks API keys that you still need, because the revoked keys no longer work and the applications using them will fail authentication until they are updated. Second, rotate third-party credentials named in your notice with the providers that issued them, then update the applications and Fireworks secrets that use them. Third, review the data and activity tied to those credentials with the issuing providers, including access logs, and rotate them even if you find nothing suspicious. Fourth, check for anything you do not recognize: API keys, users, evaluators, training jobs and datasets, and send Fireworks the names or IDs of anything unfamiliar.

The step people most often get wrong is the second one. Removing a stored secret from a platform does not cancel the underlying credential. The key has to be revoked at the provider that issued it, or it keeps working wherever it was copied. Wiz makes the same point from the other side: stolen keys in its cases were tested within 30 minutes of the vendor breach, so the window for rotation is measured in minutes, not days. Check billing, too. A sudden spike in usage, or calls from regions and models you do not use, is often the first sign a key has been taken, and Fireworks' billing data was itself part of what was accessed, so review invoices and credit usage alongside the keys.

If you were not notified, Fireworks says no incident-specific action is currently required, but the Wiz roundup is a reason to act anyway. Nine platforms disclosed incidents in a single month, and the target in every case was stored credentials. Treat any key that lived on one of those platforms as exposed until the vendor says otherwise, scope keys to the smallest permissions they need, and set spend limits where the platform allows them. Fireworks supports monthly spend limits and auto reload on its platform, which caps what a stolen key can run up before anyone notices.

Pro tips and common mistakes

• Rotate at the issuer, not just in the dashboard. Deleting a secret from Fireworks or any other platform leaves the underlying API key valid until the provider that issued it revokes it.
• Check billing before you check logs. A usage spike, a new region, or a model you never call is usually visible in the invoice before it shows up in an audit trail.
• Do not assume a zero-retention service means zero exposure. Fireworks says its inference service was not impacted, but the secrets and datasets stored around it were, and the two live in the same account.
• Do not wait for a notification to scope your keys. The November 9 update expanded a disclosure that was already a month old, and Fireworks says its investigation may reveal more.
• Keep dataset uploads in mind while the restriction lasts. Self-serve dataset uploads and downloads for Batch Inference and dataset-based training are disabled, so plan fine-tuning work around the Training SDK or Fireworks Lab instead.
• Read the disclosure, not the headline. "Incomplete model weights" and "a limited set of accounts" are narrower than a full model theft, and "no detected impact" is a finding to date, not a guarantee.

FAQ

Was my Fireworks account affected by the October 2026 breach?

Fireworks says it directly notified every customer it identified as affected, with account-specific details and recommended actions. If you did not receive a notice, the company says it has not identified your account as affected based on its investigation to date, and it will contact you directly if that changes.

What data did the Fireworks breach expose?

According to the November 9 update, the affected internal application exposed resource metadata, billing information including addresses, invoice and payment history, balances and credit usage, and, for a limited set of accounts, secrets, datasets and a subset of incomplete model weights. Payment card numbers were not stored and were not impacted.

Was Fireworks inference traffic or customer prompts leaked?

Fireworks says it has not detected any impact to Inference, the Training SDK or Nexus, which are all zero data retention by default, and its October bulletin said it had found no evidence of access to inference traffic including prompts and outputs. That finding is based on the investigation to date, and the investigation is ongoing.

What is LLMJacking, and why does it matter here?

LLMJacking is the theft of paid access to large language models, resold through illicit routing gateways called LLM Mixers. Google Threat Intelligence Group and Mandiant reported on November 2 that victims in 2026 saw fraudulent charges above $100,000 in a single day, with some reaching $1 million in total. Fireworks links its incident to a financially motivated group aiming to sell stolen LLM access this way.

How many AI platforms were breached in October 2026?

Wiz counted at least nine AI developer platforms that disclosed security incidents in October 2026: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. Wiz has since added Brev, Trigger.dev, Chainstack, kernel.sh, Blacksmith and Tensorlake in updates. Wiz says no single vulnerability or attacker links the nine.

What should I do if I stored API keys on Fireworks?

Replace any revoked Fireworks API keys, rotate third-party credentials with the providers that issued them, review access logs and billing for unfamiliar activity, and check for unrecognized keys, users, training jobs and datasets. Deleting a stored secret alone does not invalidate the underlying credential. Contact Fireworks at [email protected] if you need help confirming your account's status.

Fireworks' disclosure grew between October 9 and November 9, from secrets in evaluation jobs to billing data, datasets and model weights, plus a second intrusion through a supplier. The pattern around it is bigger than one company: nine platforms in a month, keys tested within half an hour, and a resale market that turns stolen access into a subscription product. For anyone building on these platforms, the lesson is the same one the researchers keep repeating. The keys are the product now, and they need the same care as the data they protect. This is general information, not legal or security advice.

Sources

• Fireworks AI — Update on October 2026 security incident (November 9, 2026)
• Fireworks AI — October 2026 security incident bulletin (October 9, 2026)
• Wiz — "Black October" for AI Developer Platforms (October 30, 2026)
• Google Threat Intelligence Group and Mandiant — The Rise of LLMJacking (November 2, 2026)
• Fireworks AI — Pricing (read live November 10, 2026)
• Unite.AI — Fireworks AI Expands Breach Disclosure to Datasets and Model Weights (November 9, 2026)
• Silicon Report — Fireworks expands breach disclosure to datasets and model weights (November 9, 2026)
• Maxime M. — Fireworks AI vs Together AI Pricing 2026 (October 29, 2026)

Related reading on AI Core Updates: our Fireworks Forge review covers the platform's inference pricing in detail, our OpenCode review covers another platform on Wiz's list, and our PHP2Shell analysis walks through a separate critical-flaw disclosure and patch timeline.