FIREWORKS AI CONFIRMS TWO CYBERSECURITY BREACHES EXPOSING CUSTOMER BILLING RECORDS, ACCESS CREDENTIALS AND AI DATA

SAN MATEO, CALIFORNIA — Artificial intelligence infrastructure provider Fireworks AI disclosed on November 9, 2026, that two cybersecurity incidents in October exposed customer account information, billing records, access credentials, and certain AI-related datasets and model files. The company enlisted Palo Alto Networks Unit 42 to investigate the intrusions after identifying evidence linking the activity to a financially motivated cybercriminal operation associated with LLMJacking, a technique used to hijack enterprise access to large language models and monetize stolen computing resources.

Fireworks, founded in 2022, provides infrastructure for AI model inference, training, and deployment to businesses and developers. Its platform allows organizations to integrate large language models into applications and manage associated computing resources. The company initially disclosed a security incident on October 9 after detecting unauthorized activity involving internal credentials on October 6. Its original assessment identified a limited number of customer accounts in which attackers had accessed environment variables containing sensitive authentication information used in evaluation jobs.

The initial investigation indicated that application programming interface (API) keys, tokens, and other stored secrets may have been exposed. These credentials can authorize communication between software applications, cloud services, and AI systems without requiring a person to manually authenticate each request. Unauthorized possession of such credentials can permit attackers to access protected resources, impersonate legitimate applications, or generate fraudulent service usage charges.

Fireworks began containment on October 6, notified identified customers, and revoked affected credentials. By October 10, the company had rotated employee API keys, revoked additional customer keys, and replaced service-account tokens associated with the investigation. Its initial disclosure reported no detected evidence of unauthorized access to customer models, datasets, training data, personal information, or inference traffic within the company’s security environment.

The November 9 update expanded the company’s earlier findings concerning the October security incidents. Following additional forensic analysis, Fireworks confirmed exposure involving account and billing information, along with stored secrets, datasets, and portions of incomplete AI model weights belonging to certain customers. The exposed billing information included billing and shipping addresses, invoice records, payment histories, account balances, and credit usage. Fireworks stated that it does not store customer payment card numbers and that those numbers were not affected.

A separate intrusion developed on October 23 when an external cloud provider hosting Fireworks research and development machines experienced a security incident. According to Fireworks, the unauthorized party used the compromised provider environment on October 24 to reach the company’s development systems and execute an unauthorized workload. The activity caused additional customer data exposure, extending the investigation beyond the original credential-related incident.

Fireworks detected the second intrusion on October 24 and initiated containment measures, including restricting access, addressing identified security weaknesses, and examining affected development infrastructure. The company reported that it had found no further evidence of successful unauthorized access to its customer-facing platform after October 25. That finding remains based on its investigation to date, which is continuing.

The impact extended to Notion, the digital workspace and productivity platform that relied on Fireworks for certain artificial intelligence services. Notion disclosed that Fireworks notified it on November 2 about unauthorized access involving a limited dataset initially identified as synthetic AI testing information. On November 3, Notion disconnected its systems from Fireworks, deleted data maintained within the provider’s environment, and terminated communication between the two platforms.

On November 6, Fireworks informed Notion that additional customer information might have been accessed. A further dataset confirmation on November 8 prompted Notion to examine potentially affected information and notify customers whose workspaces were identified as affected. In its November 9 advisory, Notion reported that fewer than 1% of its workspaces were affected.

Notion determined that the affected information included AI chat transcripts processed through its Insights feature, which helped customers understand usage patterns involving artificial intelligence. The company stated that most affected transcripts could not be directly attributed to particular users or workspaces because they lacked identifying labels and tool-call results. The contents of individual conversations could still contain information supplied by users, making the exposure relevant to organizations that had entered sensitive material into AI interactions.

Notion suspended its Insights feature and stopped serving open-weight AI models through Fireworks while investigating the incident. It advised affected customers to review the data made available through secure workspace notifications and rotate passwords, API keys, or other credentials if those details appeared within potentially exposed conversations. The company stated that no other Notion features were affected and that the incident did not represent a breach of Notion’s own infrastructure.

The Fireworks investigation also connects to a broader pattern of attacks targeting enterprise artificial intelligence services. On November 2, Google Threat Intelligence Group and Mandiant published research documenting multiple LLMJacking incidents during 2026 involving cloud infrastructure and AI model providers across North America, South America, and the Asia-Pacific region. The investigations identified financially motivated groups stealing authentication credentials and exploiting legitimate customer access to generate unauthorized AI computing activity.

Unlike traditional cryptojacking, which uses compromised computing resources to mine cryptocurrency, LLMJacking exploits access to commercial AI models and cloud inference services. Attackers can route requests through stolen API tokens, consume an organization’s allocated computing resources, and resell unauthorized model access through illicit intermediary services. The legitimate account holder may then receive the resulting usage charges.

Google’s investigators documented cases in which fraudulent AI resource consumption exceeded $100,000 in a single day, with cumulative charges reaching $1 million at some affected organizations before access was revoked. Those figures concern the broader incidents examined by Google and Mandiant and have not been identified as financial losses suffered by Fireworks customers in the October breaches.

The researchers also identified a developing criminal infrastructure involving specialized groups responsible for obtaining initial access and separate operators who manage illicit AI routing gateways, sometimes called LLM Mixers. These services aggregate stolen or unauthorized model access and make it available to paying users while concealing the underlying compromised accounts. This division of responsibilities allows criminal operators to exploit access credentials without maintaining their own high-cost AI computing infrastructure.

Fireworks stated that its investigation had not detected an impact on its Inference, Training SDK, or Nexus services, which use zero-data-retention configurations by default. As part of its containment strategy, the company temporarily disabled self-service dataset uploads and downloads for Batch Inference and dataset-based training. Its Training SDK remained available, while laboratory-based training continued operating within isolated environments with additional storage and network protections.

Working with Palo Alto Networks Unit 42, Fireworks implemented additional security controls involving credential revocation, service-account permissions, network isolation, data storage access, and forensic logging. The company also tightened restrictions intended to prevent unauthorized credential creation and movement between internal environments. Customers whose information was identified as affected have been contacted with account-specific findings and recommended protective actions.

The two incidents expose separate security risks facing AI infrastructure providers: the theft of credentials that grant access to commercial language models and the compromise of development environments through external cloud service dependencies. Both can expose customer information beyond the systems directly targeted by attackers, particularly when an AI provider processes information on behalf of other businesses.

Fireworks continues monitoring its infrastructure and assessing the full extent of the October intrusions. The confirmed exposure of billing records, authentication secrets, and selected AI datasets demonstrates that attacks against artificial intelligence platforms can involve both unauthorized resource consumption and access to sensitive customer information. The investigation remains active as Fireworks and affected customers complete remediation and determine whether further protective measures are required.

Fireworks AI, Inc. — “Fireworks October 2026 Security Incident,” Official Security Bulletin, published October 9, 2026; last updated October 10, 2026. (Free Download)

Fireworks AI, Inc. — “Update on October 2026 Security Incident,” Official Security Bulletin, November 9, 2026. (Free Download)

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE