Fireworks AI, the Nvidia-backed inference startup, has notified customers that a previously disclosed security incident was significantly broader than first reported, with attackers accessing account and billing information and, for a limited set of accounts, secrets, datasets, and incomplete model weights, according to an updated security bulletin published on its site on November 9. Bloomberg and Forbes reported the disclosure on Monday, with Forbes describing the cyberattack as exposing customer data and AI models.
The company first disclosed the incident on October 9, when it said only Fireworks-stored secrets used in evaluation jobs had been accessed. The new update substantially widens that assessment and ties the intrusion to a financially motivated cybercriminal group pursuing what the industry calls "LLMJacking" — stealing access to large language models and reselling the tokens to illicit routing gateways. For companies tracking AI industry security news, the case is shaping up as a reference incident for a new class of attacks on AI infrastructure.
How the Second Breach Unfolded
According to the bulletin, a third-party cloud provider hosting Fireworks' research and development machines experienced its own security incident on October 23. The next day, an unauthorized party used that foothold to reach Fireworks development machines and ran an unauthorized workload that led to additional customer data impact. Fireworks says it detected the activity the same day and took remediation measures, and that as of October 25 it has found no further evidence of successful unauthorized access on the platform customers use.
The company is working with Palo Alto Networks' Unit 42, which is conducting forensic analysis, and said it notified law enforcement after the original incident. Google Threat Intelligence Group and Mandiant published a blog post on November 2 documenting the rise of LLMJacking, the motives behind it, and the techniques used — context Fireworks cited in its own disclosure.
What Data Was Taken
The affected internal application exposed several categories of information, per the bulletin:
- Resource metadata, including Fireworks resource identifiers, display names, descriptions, and creation times.
- Billing information, including billing and shipping addresses, invoice and payment history, account balances, and credit usage.
- Model weights and datasets: for certain customers, a subset of incomplete model weights and datasets were accessed.
Fireworks said payment card numbers are not stored on its systems and were not impacted. It also stated that it has detected no impact to its core Inference, Training SDK, and Nexus services, which operate with zero data retention by default — meaning no customer training or inference data is stored at rest. The company said it is directly notifying customers whose data was affected with details on the impact and recommended response actions.
Containment and Open Questions
As part of its response, working with Unit 42, Fireworks says it revoked and replaced credentials and service accounts, removed unnecessary elevated privileges, restricted network pathways and isolated affected systems, tightened access to data storage and analytics systems, and hardened logging and monitoring. It has also disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training while the investigation continues.
Two significant questions remain open. First, how much of the accessed "incomplete model weights" are actually usable — partial or in-progress weights stolen from a training pipeline may still reveal competitive information about customer models under development, and Fireworks has not said which customers or how many were affected. Second, what obligations follow for customers whose proprietary datasets were exposed. The company says its investigation is ongoing and may reveal additional information.
Why LLMJacking Is Growing
LLMJacking attacks target cloud-hosted AI services to harvest usable model access rather than traditional data. The stolen credentials or tokens are then resold through shadow routing gateways that offer cut-price access to commercial models. Google's Threat Intelligence Group and Mandiant devoted a November 2 report to the trend, which security researchers have tracked for roughly two years as enterprise adoption of hosted inference has exploded.
The Fireworks disclosure is one of the first confirmed cases where attackers appear to have combined that playbook with theft of customer model artifacts at an AI infrastructure provider. It lands amid a broader wave of security incidents across the AI ecosystem and adds pressure on inference providers to demonstrate that multi-tenant platforms can isolate customer workloads. Startups evaluating inference vendors are likely to ask harder questions about tenant isolation, credential hygiene, and third-party cloud dependencies — the exact pathway exploited here.
Fireworks says it is monitoring its systems around the clock and will publish further updates as the investigation progresses. Customers with concerns are directed to reply to their incident notification emails or contact the company's security-notice address.
The incident also illustrates how disclosure norms are maturing for AI companies. Fireworks published its first bulletin within days of the initial intrusion in early October, then amended it twice as forensics widened the picture — a sequence security teams will recognize from recent enterprise software breaches but that remains uncommon among AI infrastructure providers, many of which have never handled a public incident. The choice to disable self-serve dataset features while leaving the core inference product running suggests the exposure was concentrated in ancillary systems rather than the customer-serving path itself.
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
