Fireworks AI has disclosed a second, more severe security breach occurring in October, significantly expanding the scope of customer data exposure beyond what was initially reported. This latest incident, which the company confirmed began on October 23, originated from a compromise at a third-party cloud provider that hosted the company’s research and development infrastructure. According to Fireworks AI, attackers leveraged this access on October 24 to infiltrate internal development systems and execute unauthorized workloads.
The company is currently investigating potential links between this breach and a trend known as LLMJacking, where malicious actors gain unauthorized access to AI models to sell compute resources or model access through illicit channels. While the company has not disclosed the total number of affected customers, it has categorized the compromised information into three distinct groups: resource metadata, billing details, and specific model assets.
Resource metadata exposed in the breach includes unique identifiers, display names, descriptions, and creation timestamps for various projects. The billing information accessed includes shipping and billing addresses, invoice histories, and account balances. Fireworks AI stated that payment card numbers were not stored on the affected systems and therefore remain secure. Additionally, the company confirmed that a subset of incomplete model weights and datasets belonging to certain customers was accessed during the intrusion.
The impact of the breach has extended to third-party services that utilize Fireworks AI technology. Notion notified some of its customers, including the cloud platform Render, that their AI assistant chat transcripts may have been exposed. Notion indicated that while the exposed transcripts lacked direct identifiers linking them to specific workspaces or users, the contents of the chats themselves could potentially contain sensitive information. Fireworks AI is currently coordinating with other high-profile customers, including Cursor and Harvey, to evaluate the extent of the impact on their respective operations.
This October 23 incident follows an earlier security disclosure from Fireworks AI on October 9. In that initial event, which the company traced back to October 6, unauthorized parties gained access to internal credentials. That earlier breach resulted in the exposure of environment variables within evaluation jobs, including customer-specific API keys and tokens. At the time of the first disclosure, the company claimed there was no evidence that models, training data, or personal information had been compromised.
The company’s leadership has addressed concerns regarding the intent of the attackers, specifically regarding the theft of intellectual property. While some security researchers questioned whether the goal was to exfiltrate proprietary model weights, Fireworks AI CEO Lin Qiao stated that the observed activity suggested otherwise. According to the company, most of the data downloads were partial and were terminated before completion, leading them to conclude that the attackers were primarily focused on unauthorized compute usage rather than the wholesale theft of models.
To address the October 23 breach, Fireworks AI engaged the Unit 42 incident response team from Palo Alto Networks. Remediation efforts included a comprehensive rotation of credentials, the isolation of compromised systems from the broader network, and the implementation of more stringent access controls and monitoring for data storage systems.
Despite these remediation efforts, the two October incidents represent a significant escalation in the company's security challenges. The company has not provided a definitive count of the total number of customers impacted by either the October 6 or October 23 events. As the investigation continues, the focus remains on assessing the potential for further data leakage and ensuring that the unauthorized workloads have been fully purged from the development environment.
