Fireworks AI breach #2: secrets, datasets and model weights

Fireworks AI has had its second breach in about a month, and this one is worse. On November 9, the inference provider updated its security bulletin: attackers reached account and billing data, and for a limited set of accounts they also reached secrets, datasets and incomplete model weights. Bloomberg reports the company is working with customers including Notion and Cursor. If you stored a key with any AI vendor, this is your reminder to check what's sitting there.

What actually happened

From Fireworks' own bulletins:

• First incident, October 6. Someone used internal Fireworks credentials to read environment variables in evaluation jobs for a limited number of customer accounts. Those included API keys and tokens stored as secrets. Fireworks published a bulletin on October 9 and said at the time it had no evidence of access to models, datasets or inference traffic.
• Second incident, October 23–24. A third-party cloud provider that hosted Fireworks R&D machines was breached on October 23. On October 24 the attacker used that access to run an unauthorized workload on Fireworks development machines. Fireworks says it detected this the same day.
• What was reached. Resource metadata, billing details (addresses, invoices, payment history, balance, credit usage), and for some customers secrets, datasets and incomplete model weights. Fireworks says it doesn't store card numbers.
• What wasn't. Fireworks says it has seen no impact to Inference, the Training SDK or Nexus, which are zero data retention by default.
• Who did it. Fireworks links the attack to a financially motivated group that resells stolen access to LLMs, known as LLMjacking. Palo Alto Networks Unit 42 is doing the forensics, and law enforcement has been notified.

Fireworks hasn't said how many customers were affected, and it hasn't named the cloud provider.

Why it matters for your business

LLMjacking is about your keys, not your prompts. The attacker wants credentials that let them run models on someone else's bill. Every OpenAI, Anthropic or Hugging Face token you pasted into a vendor's "secrets" field is a target.

What we'd do this week:

1. List every place you stored a third-party key. Inference hosts, eval tools, agent platforms, CI.
2. Rotate at the issuer. Fireworks' first bulletin makes the key point: deleting a stored secret doesn't invalidate the credential. Revoke it where it was issued.
3. Set spend caps and alerts on every model key, so a stolen one hits a ceiling fast.
4. Treat uploaded datasets as disclosed if they held customer data, and check your notice duties.
5. Read your vendor's bulletin page, not just your inbox.

Sources: Fireworks AI security bulletin (Nov 9 update), Fireworks AI security bulletin (Oct 9), Bloomberg Law.