Fireworks AI discloses second breach tied to compromised cloud provider

Fireworks AI issued a Monday advisory on Nov. 9, 2026, disclosing that attackers reached its development machines by way of a compromised third-party cloud provider. It was the startup’s second known hack in weeks, following an intrusion that began Oct. 6, 2026. The company, which serves more than 10,000 customers including Harvey, Notion and Cursor, told law enforcement and hired Palo Alto Networks’ Unit 42 for forensic analysis.

A security incident struck the third-party cloud provider hosting Fireworks’ research and development machines on Oct. 23, 2026. An intruder then used that access to reach Fireworks’ development machines and run a workload that exposed customer data. Fireworks said it detected the activity on Oct. 24, acted right away, closed known critical vulnerabilities, and by Oct. 25 had found no further successful access on the platform serving customers. The incident links development machines and third-party infrastructure to exposed AI assets and disrupted model-building workflows.

Resource metadata was taken, including creation times, descriptions, display names and identifiers, along with billing details such as balances, credit usage, addresses and invoice and payment history. The intruders also reached incomplete model weights and datasets for a limited group of customers. According to a person familiar with the matter, the breach involved tens of thousands of files containing customer data in some cases. Fireworks said it does not store payment card numbers, so none were exposed.

The first incident started Oct. 6, 2026, when intruders misused internal credentials and read environment variables for evaluation jobs for a limited number of accounts. In an Oct. 9, 2026 bulletin, Fireworks first disclosed the October incident and described it at first as unauthorized use of internal credentials. Customer notifications began Oct. 7, 2026, Fireworks changed employee API keys Oct. 9, 2026, and Fireworks revoked added user keys while rotating service-account tokens Oct. 10, 2026.

The company said evidence links activity from early October to a financially motivated cybercriminal group that wanted to sell unauthorized access to large language models through gateways used for illicit routing, a practice called LLMJacking. “The evidence indicates links to a cybercriminal threat actor group,” the company said. A spokesperson added the company is “actively working with our customers to manage the incident, including Notion, Cursor and others.” The company offered no responsibility details for the most recent breach.

Research from Google Threat Intelligence Group and Mandiant dated Nov. 2, 2026 describes LLM Mixers as illicit gateways used to move, combine and sell stolen access to models for subscribers. The researchers said fraudulent charges topped $100,000 in a single day in some incidents and reached $1 million in total at certain organizations before access ended, adding that the figures cover wider investigations rather than Fireworks’ losses. The researchers said exposed or stolen cloud identity tokens served as the most common initial entry method in those cases. The researchers also recommended centralized secrets handling, least-privilege access, regular audits, spending caps and watches for unusual low-volume requests that could test stolen credentials without triggering volume-based alerts.

Notion said Fireworks notified it on Nov. 6, 2026 that an incident affected under 1% of Notion workspaces. Notion said that after Fireworks reported limited data access on the evening of Nov. 2, it severed ties with Fireworks, deleted data stored there, and stopped communications by the morning of Nov. 3. On Nov. 8, 2026, Fireworks confirmed to Notion that newly accessed material included AI chat transcripts for the Insights feature, mostly unattributable and lacking tool call results, according to Notion. Notion said it disabled its Insights feature and stopped serving open-weight models through Fireworks.

The company sells an inference platform letting developers run open-source models such as Mistral, Meta’s Llama and Google’s Gemma without managing hardware themselves. Nvidia Corp. and Advanced Micro Devices Inc. are among the startup’s backers. The last valuation was $17.5 billion in July, according to the reporting, and people familiar with the matter say the company is discussing a new funding round valued at $30 billion to $40 billion.

According to Fireworks, its documentation avoids logging or storing open-model prompts and generations unless users opt in, and Nexus retains service metadata before de-identifying it after 30 days. Training SDK remains available and stores no training data at rest, while Fireworks Lab-based training runs in an isolated setting with added network and storage protection. Fireworks says it has found no impact on Inference, Training SDK and Nexus, which keep no data by default, though the finding covers only the investigation so far.

Fireworks revoked and replaced credentials along with service accounts, removed excess privileges, blocked unauthorized network paths, isolated affected systems, tightened storage and analytics access, and improved logging and monitoring. During the investigation, Fireworks blocked customers from uploading or downloading datasets used for Batch Inference and dataset-based training.

Fireworks advised affected customers to replace revoked API keys, rotate third-party credentials through their issuers, and review logs for unknown keys, users, training jobs or datasets. It said deleting a saved secret does not cancel the underlying credential. Fireworks said the investigation is still open and could turn up more findings, while affected customers receive details and next steps for their accounts.