Read the full analysis: Fireworks AI Breach: Reviewing Datasets, Models, And Access on ThorstenMeyerAI.com
TL;DR
Fireworks AI’s November 9 update says an October security incident reached account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. The company describes two routes of access, including an incident at an unnamed cloud provider; Notion says transcripts from its AI Insights feature may have been in an accessed dataset.
Fireworks AI said on November 9 that an October security incident reached account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models—a broader impact than the company described in its first bulletin. The AI platform provider said attackers used internal credentials and later accessed development machines through an incident at an unnamed third-party cloud provider.
In its November 9 update, Fireworks said the affected information included resource metadata, such as identifiers, names and descriptions; billing and shipping addresses, invoice and payment history, account balances and credit usage; and, for certain customers, a subset of datasets and incomplete model weights. It did not say how many customers or accounts were affected. The company said payment card numbers were not exposed because Fireworks does not store them.
Fireworks described two stages. It said it identified activity on October 6 and began containment, then started notifying affected customers on October 7. Its October 9 bulletin said internal credentials had been misused to read environment variables from some customers’ evaluation jobs. On October 23, a security incident affected an unnamed cloud provider that hosted Fireworks research and development machines. Fireworks said an unauthorized party used that access on October 24 to reach development machines and run an unauthorized workload that caused additional customer data impact. The company said it detected that activity the same day.
Fireworks said it rotated employee API keys, revoked additional user API keys and rotated service-account tokens. It reported no further evidence of successful unauthorized access to the customer-facing platform after October 25. The company said it notified law enforcement and brought in Palo Alto Networks Unit 42 to assist with forensic work. It also temporarily disabled self-service dataset uploads and downloads used by batch inference and dataset-based training.
Fireworks AI breach What the update reveals
Fireworks AI’s November 9 update broadened its account of an October incident. Customer and billing information was accessed, along with sensitive materials for a limited set of accounts.
What information was affected
The reported scope includes account and billing records, plus certain customer materials.
Metadata and billing
Resource details, addresses, invoice and payment history, account balances and credit usage.
Secrets and model assets
Fireworks reported access to secrets, a subset of datasets and incomplete model weights.
Numbers not stored
Fireworks said payment card numbers were not exposed because it does not store them.
Two routes of access
Fireworks described credential misuse and a later incident involving an unnamed cloud provider.
Attackers read environment variables from some customer evaluation jobs.
After a cloud provider incident on October 23, unauthorized access reached Fireworks development machines on October 24.
An unauthorized workload caused additional customer data impact; Fireworks said it detected this activity the same day.
What the update adds
The November disclosure expanded on the first public bulletin.
Described misuse of internal credentials and access to environment variables.Reported no detected access to customer models, datasets or personal information at that time.
Added account and billing information to the reported impact.Reported secrets, datasets and incomplete models affected for a limited set of accounts.
What customers should know
The public update leaves important questions open for businesses using AI infrastructure.
Risks for AI Platform Customers
The incident matters because Fireworks runs and fine-tunes models for businesses, placing customer-provided data and model assets within a third-party service. Exposure of datasets, secrets or model weights could create risks beyond ordinary account or billing disclosure: those materials may include business information or work built through customer training. The company has not described the contents of the affected datasets or the practical usability of the incomplete weights, so the extent of those risks cannot yet be assessed.
Notion said chat transcripts from its Notion AI Insights feature were in a dataset that attackers may have accessed. The company put the share of affected workspaces at fewer than 1%. That is a statement from Notion, not a count of all Fireworks customers or a measure of how many individual transcripts were viewed. For organizations using AI infrastructure providers, the update highlights the importance of knowing what information is sent to those services and how third-party incidents are handled.
From Initial Bulletin to Broader Scope
Fireworks’ first public bulletin, dated October 9, described misuse of internal credentials and access to environment variables in a limited number of customer accounts. At that point, the company said it had not detected unauthorized access to customer models, datasets, training data, inference traffic—including prompts and outputs—or personal information. The November 9 update added account and billing information, plus datasets, secrets and incomplete models for a limited set of accounts.
Notion’s advisory describes a later notification sequence: Fireworks initially told the company on November 2 about a dataset it characterized as synthetic test data. On November 6, Fireworks said malicious actors may have accessed potential customer data, and on November 8 it confirmed the dataset involved. Fireworks’ November 9 disclosure therefore came 34 days after its October 6 detection, and the public account changed as the investigation and customer notifications progressed.
“For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models.”
— Fireworks AI, November 9 security update
Scope and Data Use Still Unknown
Fireworks has not identified the third-party cloud provider, disclosed the number of affected customers, or explained how the internal credentials were first obtained. It has not said whether attackers copied, retained, shared or otherwise used the data they accessed. The company also has not defined what “incomplete” means for the affected model weights or described how many datasets or models were involved.
The company says its investigation is ongoing and may reveal additional information. Its statement that it has detected no further successful access since October 25 is a report on what its investigation had found as of the update, not a guarantee that no additional information will emerge. Notion’s figure of fewer than 1% applies to its affected workspaces, not to the overall Fireworks customer base.
Investigation and Customer Notifications
Fireworks said it is continuing its investigation with assistance from Unit 42 and has notified law enforcement. It has not announced a date for a final report or said when dataset uploads and downloads will be restored. Customers should look for direct notices from Fireworks about whether their accounts or materials were affected; the public update does not provide a complete customer-by-customer list.
The next public milestones are likely to be further findings about the access routes, affected data and safeguards, if Fireworks releases them. Until then, the number of affected accounts, the identity of the cloud provider and the fate of accessed data remain unresolved.
Key Questions
What information did Fireworks AI say was affected?
Fireworks reported access to account and billing information and, for a limited set of accounts, secrets, datasets and incomplete model weights. It also listed resource metadata. The company said it does not store payment card numbers and that they were not affected.
How did the incident happen?
Fireworks described two routes: misuse of internal credentials to read environment variables from some customer evaluation jobs, followed by access to development machines through a security incident at an unnamed cloud provider. The company said the latter access led to an unauthorized workload on October 24.
Were Notion AI conversations involved?
Notion said transcripts from its AI Insights feature were in a dataset attackers may have accessed. Notion said fewer than 1% of its workspaces were affected. Whether the transcripts were copied or used has not been disclosed.
What remains unknown?
Fireworks has not named the cloud provider, said how many customers were affected, explained how the internal credentials were obtained, or disclosed what happened to the accessed data. It also has not clarified what it means by incomplete model weights.
Source: ThorstenMeyerAI.com