Fireworks AI says an unauthorized party reached its development machines on 24 October 2026 through a third-party cloud provider, exposing billing records and, for a limited set of accounts, secrets, datasets, and incomplete model weights, with the activity detected the same day, no further successful access on the customer platform seen since 25 October, no published account count, and no card numbers stored.
What are the details of the second data breach at Fireworks AI? The account below follows Fireworks’ own bulletins. The first, published on 9 October 2026 and updated on 10 October, described a different intrusion on 6 October. The second write-up is an update dated 9 November 2026. Figures are as of that update. Bdeb Technology is not a Fireworks customer and has not seen the customer notices.
What are the details of the second data breach at Fireworks AI
Fireworks’ 9 November update says a third-party cloud provider that hosted Fireworks research and development machines had a security incident on 23 October. On 24 October the unauthorized party used that opening to reach Fireworks development machines and run an unauthorized workload. Fireworks says it detected this the same day, closed the critical holes it knew about, and has not detected further successful unauthorized access on the customer platform since 25 October. The cloud provider is not named. A dollar loss is not stated. An account count is not stated.
The update says the evidence points to a financially motivated criminal group that sells tokens taken from unauthorized access to large language models, through illicit routing gateways. Fireworks calls that practice LLMJacking, and it points readers to a 2 November 2026 post by Google Threat Intelligence Group and Mandiant. Google’s dollar figures in that post are from incidents Google investigated at other organizations. They are not a Fireworks loss. Google said fraudulent charges in those incidents exceeded $100,000 in a single day, and that cumulative charges at some organizations reached $1 million before access was cut off.
How this differs from the 6 October incident
The first bulletin is a narrower event. On 6 October 2026, at 9am PDT, Fireworks identified unauthorized use of internal Fireworks credentials. Those credentials were used to read environment variables on evaluation jobs in a limited number of customer accounts. Fireworks said it believed API keys and tokens stored as secrets were captured. At that time it said it had not detected access to customer models, datasets, training data, personal information, or inference traffic, including prompts and outputs. The 9 November update widens the story. It says that after the first bulletin, the company found impact to account and billing information, and, for a limited set of accounts, to secrets, datasets, and incomplete models.
| First bulletin, updated 10 October 2026 | Update dated 9 November 2026 | |
|---|---|---|
| When | 6 October 2026, 9am PDT, identified and containment started | Cloud-provider incident on 23 October. Development machines reached on 24 October. Detected the same day. |
| Path | Unauthorized use of internal Fireworks credentials | A third-party cloud provider that hosted research and development machines |
| Data Fireworks says was reached | Environment variables, including API keys and tokens, on evaluation jobs in a limited number of accounts | Resource metadata and billing data. For a limited set of accounts, secrets, datasets, and incomplete model weights. |
| What Fireworks says it had not detected | Models, datasets, training data, personal information, or inference traffic, as of that bulletin | Impact on Inference, the Training SDK, or Nexus. Card numbers are not stored. The investigation is still open. |
| Outside help named | A cybersecurity firm, not named in the first bulletin | Law enforcement, and Palo Alto Networks Unit 42 |
The first bulletin’s timeline, which it labels in PDT, continues after the 6 October discovery. Notifications to affected customers started at 7am PDT on 7 October. Employee API keys were rotated at 4pm PDT on 9 October. Identified affected customers were notified at 6pm PDT on 9 October. The bulletin was published at 10pm PDT on 9 October. On 10 October, Fireworks revoked more user API keys and rotated service-account tokens found in a credential review, and said further review was continuing.
What the update says was exposed
The affected internal application could reach three kinds of information.
- Resource metadata, including Fireworks resource identifiers, display names, descriptions, and creation time.
- Billing information, including billing and shipping addresses, invoice and payment history, account balance, and credit usage. Fireworks says it does not store payment card numbers, and that card numbers were not impacted.
- For certain customers, a subset of incomplete model weights and datasets. The update also says a limited set of accounts had secrets impacted.
Fireworks says it has not detected any impact to Inference, the Training SDK, or Nexus. Those products are zero data retention by default, which means prompts and outputs are not kept. The company says these findings are based on the investigation so far, and that the investigation may reveal more. It is notifying affected customers directly, with recommended actions. It does not say, in the public update, what share of its customers that list covers.
What Fireworks says it changed
Working with Unit 42, Fireworks says it revoked and replaced credentials and service accounts, removed elevated privileges it no longer needed, and tightened controls meant to stop new unauthorized credentials. It restricted network paths and isolated affected systems. It tightened access to storage and analytics systems. It expanded logging and monitoring.
It has also turned off self-serve dataset uploads and downloads used by Batch Inference and by dataset-based training, for the duration of the investigation. The Training SDK remains available with zero data retention, so training data is not stored at rest. Fireworks Lab training, the company says, runs in an isolated environment with extra network and storage protection. The public contact for the update is a reply to the incident email, or security-notice@fireworks.ai. The October bulletin used security@fireworks.ai.
What a customer notice asks for
The October bulletin told identified customers to do four things. Replace revoked Fireworks API keys in any application that still uses them, because those keys no longer authenticate. Rotate each third-party credential named in the notice at the provider that issued it, then update the applications and the Fireworks secrets that store it. Deleting the copy stored at Fireworks does not invalidate the key. Review that provider’s logs for unexpected reads, downloads, or changes. Check the Fireworks account for API keys, users, evaluators, training jobs, or datasets the customer does not recognize, and send the names to Fireworks.
The November update does not repeat that list. It says affected customers are being told what to do. Anyone with a notice should follow the notice they received, including a newer one if the widened scope adds datasets or model files. Anyone who has not been contacted has not been named in the public bulletins. Fireworks also says the investigation is not finished. A stored provider key is a bill and a data store at the company that issued it, which is why the place a key is allowed to sit matters when you choose an AI coding tool, when you decide where sensitive work should not go, and when you watch metered API spend.
Sources
- Fireworks AI, Update on October 2026 security incident, last updated 9 November 2026. The 23 and 24 October path, the data categories, the products Fireworks says were not impacted, Unit 42, and the dataset-upload change.
- Fireworks AI, October 2026 security incident, last updated 10 October 2026, 11:16 PDT. The 6 October credential incident, the PDT timeline, and the customer rotation steps.
- Google Threat Intelligence Group and Mandiant, The Rise of LLMJacking, 2 November 2026. Background Fireworks cites. The $100,000-a-day and $1 million figures are from incidents Google investigated, not a Fireworks loss figure.
- Photograph: Fireworks founding team at the San Mateo headquarters, company handout published by CNBC, 16 July 2026.
What are the details of the second data breach at Fireworks AI
Fireworks says a cloud provider that hosted its research machines had an incident on 23 October 2026. On 24 October an unauthorized party used that access to reach Fireworks development machines. The 9 November update says the exposed material includes resource metadata and billing details and, for a limited set of accounts, secrets, datasets, and incomplete model weights. Card numbers were not stored. Fireworks has not published how many accounts were affected.
How is the 24 October intrusion different from the 6 October one?
The 9 October bulletin, updated on 10 October, described unauthorized internal credentials that reached secrets in evaluation jobs. At that time Fireworks said it had not detected access to models, datasets, training data, or personal information. The 9 November update says a later intrusion, on 24 October, reached billing data and, for some accounts, datasets and incomplete models.
Did the intrusion expose card numbers or prompts?
Fireworks says it does not store payment card numbers, so card numbers were not impacted. It also says it has not detected an impact on Inference, the Training SDK, or Nexus, which run with zero data retention by default. The company says the investigation is still open and may reveal more.
What should a Fireworks customer do?
Fireworks is emailing customers whose data was impacted. The October bulletin told those customers to replace revoked Fireworks keys and to rotate any named third-party credential at the provider that issued it, because deleting the stored secret does not invalidate the key. Follow the notice you received. The public update does not say that silence means an account was unaffected, and it says the investigation may still find more.