🔍 Read the full analysis: AI Data And Model Weights In Focus As Fireworks Breach Widens on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Fireworks AI’s November 9 update says an October security incident involved account and billing information, and that secrets, datasets and incomplete model weights were accessed for a limited set of accounts. The company describes two routes of access, including an October 24 intrusion through a third-party cloud provider. The number of affected customers and what happened to any accessed data remain unclear.
Fireworks AI said on November 9 that an October security incident exposed account and billing information and, for a limited set of accounts, secrets, datasets and incomplete model weights. The company also disclosed a second route of access through a third-party cloud provider that hosted its research and development machines, expanding the scope of an incident it first described publicly on October 9.
Fireworks says the incident involved two episodes. On October 6, it identified activity in which someone used internal Fireworks credentials to read environment variables from customer evaluation jobs. Such variables can contain keys or tokens used by software. Fireworks says it began containment that day and started notifying affected customers on October 7. It published its first bulletin on October 9, saying then that it had not detected unauthorized access to customer models, datasets, training data, inference traffic or personal information.
The company’s November update adds that it later found impacts to account and billing information. It lists billing and shipping addresses, invoice and payment history, account balances and credit usage among the information available through an affected internal application. For certain customers, Fireworks says a subset of datasets and incomplete model weights was accessed. It has not explained what “incomplete” means or specified the number of affected accounts.
A separate incident at a third-party cloud provider hosting Fireworks R&D machines occurred on October 23, according to Fireworks. The company says an unauthorized party used that access on October 24 to reach development machines and run an unauthorized workload, causing additional customer-data impact. Fireworks says it detected this activity the same day and has not detected further evidence of successful access by the actor on the customer platform since October 25. It says it notified law enforcement and engaged Palo Alto Networks Unit 42 to conduct forensic work.
Fireworks AI breach widens data and model weights in focus
Fireworks AI’s November 9 update describes two access episodes and additional impacts found during its investigation. The affected customer count and the fate of accessed data remain unclear.
What Fireworks says was affected
The November update adds impacts beyond those described in the company’s first bulletin.
Account and billing information
Available information included addresses, invoice and payment history, balances and credit usage.
Secrets, datasets and weights
For a limited set of accounts, Fireworks says secrets, a subset of datasets and incomplete model weights were accessed.
Card numbers not stored
Fireworks says it does not store payment card numbers and they were not affected.
Two routes of access
The company describes an initial credential misuse and a later intrusion through a third-party cloud provider.
On October 6, someone used internal Fireworks credentials to read environment variables, which can contain software keys or tokens.
After an incident at a third-party cloud provider on October 23, an unauthorized party accessed development machines on October 24 and ran an unauthorized workload.
Response and customer impact
Fireworks says it took containment steps and is continuing its investigation.
- Revoked or rotated employee API keys and service-account tokens.
- Disabled self-service dataset uploads and downloads for Batch Inference and dataset-based training.
- Notified law enforcement and engaged Palo Alto Networks Unit 42.
- Total number of affected customers or accounts.
- Whether accessed data was copied, shared or misused.
- What “incomplete model weights” contained or could enable.
- Which third-party cloud provider was involved.
Why Model and Dataset Access Matters
Fireworks operates infrastructure that businesses use to run and fine-tune open AI models. That role can place customer datasets, model development materials and service credentials within reach of systems used by outside organizations. The disclosure therefore matters not just for billing and account records: datasets and model weights can contain commercially sensitive work, while exposed secrets may create risks beyond the original service if they remain usable elsewhere.
Fireworks says the affected weights were incomplete, but has not described their state or whether they could be used, reconstructed or further developed. Nor has it said what the accessed data contained in each case. The practical consequences for customers will depend on those details, along with whether any credentials were exposed and whether accessed information was copied or misused.
Notion said chat transcripts from its Notion AI Insights feature were in a dataset attackers may have accessed. The company put the share of affected workspaces at fewer than 1%. That is a statement from Notion about its own exposure; it does not establish the total number of Fireworks customers or accounts affected.
Products Worth Considering
Amazon Kindle Paperwhite (2024, 16 GB) – 7-inch Glare-Free Display, Black
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
Jackery Explorer 300 Portable Power Station with SolarSaga 100W Solar Panel
As an affiliate, we earn on qualifying purchases.
How the Disclosure Expanded
Fireworks’ October 9 bulletin described the initial credential misuse and said it had not detected access to customer models, datasets, training data, inference prompts and outputs, or personal information. Its November 9 update says the investigation later identified additional impacts. The sequence shows that the company’s account of the incident changed as its review continued; it does not, by itself, establish when each affected data category was accessed.
Fireworks says it revoked or rotated employee API keys and service-account tokens in October. It also says it disabled self-service dataset uploads and downloads used by Batch Inference and dataset-based training while the investigation proceeds. The company says it has not detected impact to Inference, Training SDK or Nexus, which it describes as zero-data-retention by default. It also says it does not store payment card numbers and that card numbers were not affected.
Notion’s advisory describes a notification sequence from November 2 to November 8: Fireworks first identified a small dataset as synthetic test data, then said on November 6 that potential customer data may have been accessed, and confirmed the dataset on November 8. The details in the two companies’ notices provide a limited picture of how the investigation and customer notifications developed.
“For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models.”
— Fireworks AI, November 9 security update
Affected Accounts and Data Still Unclear
Fireworks has not disclosed how many customers or accounts were affected, named the third-party cloud provider, or explained how the internal credentials used in the first episode were obtained. It has not said whether the accessed information was downloaded, shared or used, or whether any exposed secrets were valid and subsequently revoked.
The company’s description of “incomplete model weights” is also not specific enough to establish what the material contained or how useful it might be. Fireworks says its investigation is ongoing, so the categories and scope it has reported may not be final. Notion’s statement applies to its workspaces and does not answer broader questions about other Fireworks customers.
Investigation and Customer Notices Continue
Fireworks says it is continuing its investigation with Unit 42 and has notified law enforcement. It says it will provide affected customers with information relevant to their accounts and has suspended certain dataset upload and download functions while it reviews the incident. Customers using those services may face limits until the company changes or lifts the precaution.
The next public details to watch for are a clearer account of the number of affected customers, the third-party provider involved, the specific datasets and model materials accessed, and whether investigators found evidence of data being taken or misused. Fireworks has not provided a date for a final report or a timetable for restoring the disabled functions.
Key Questions
What did Fireworks AI say was exposed?
Fireworks says account and billing information were affected and that, for a limited set of accounts, secrets, datasets and incomplete model weights were accessed. It has not published a total number of affected accounts.
How did the attackers get access?
Fireworks describes two episodes: misuse of internal credentials to read environment variables from customer evaluation jobs, and a later intrusion through a third-party cloud provider hosting R&D machines. It has not said how the credentials were first obtained or identified the provider.
Were payment card numbers exposed?
Fireworks says it does not store payment card numbers and that they were not affected. The company did report exposure of other billing-related details, including addresses, invoice and payment history, account balances and credit usage.
Was Notion customer information involved?
Notion said chat transcripts from its Notion AI Insights feature were in a dataset attackers may have accessed. It said fewer than 1% of its workspaces were affected; that figure concerns Notion workspaces, not all Fireworks customers.
What happens to Fireworks services now?
Fireworks says it has disabled self-service dataset uploads and downloads for Batch Inference and dataset-based training while it investigates. It has not announced when those functions will return.
Source: ThorstenMeyerAI.com
