Fireworks, the AI inference and training platform, has told customers that attackers reached account and billing information and, for a limited set of accounts, secrets, datasets and incomplete model weights. The company published the update on Monday as an extension of an October security incident it first disclosed on 9 October.
Fireworks, the most highly-valued out of a growing group of inference providers, told customers including Harvey that it had been hit with a hack that exposed customer data. Some customers are now considering moving their business off the platform.
— Stephanie Palazzolo (@steph_palazzolo) November 9, 2026
https://t.co/r33EeFDygx
Stephanie Palazzolo of The Information reported that Fireworks had told customers including legal AI company Harvey about a hack that exposed customer data, and that some customers were considering leaving the platform. Fireworks’ own security bulletin update confirms a broader impact than its first disclosure and describes a second intrusion path through a third-party cloud provider.
What Fireworks says was accessed
In its Monday update, Fireworks said that when it published its 9 October bulletin, only Fireworks-stored secrets used in evaluation jobs were known to have been accessed. Since then, it says it has found impacts to account and billing information. For a limited set of accounts, it also found impact to secrets, datasets and incomplete models.
The bulletin lists three categories of information available through the affected internal application:
- Resource metadata, such as Fireworks resource identifiers, display names, descriptions and creation times
- Billing information, including billing and shipping addresses, invoice and payment history, account balance and credit usage. Fireworks says it does not store payment card numbers and that those were not impacted
- For certain customers, a subset of incomplete model weights and datasets
Fireworks says it is notifying customers whose data was impacted and giving them account-specific details and recommended responses. It says it has not detected impact to Inference, Training SDK or Nexus, which it describes as zero data retention by default, and that those findings are based on the investigation so far. The investigation is ongoing.
Two paths into the company
The first path, disclosed in October, involved unauthorized use of internal Fireworks credentials. On 6 October, Fireworks identified that an unauthorized third party had accessed environment variables used in evaluation jobs in a limited number of customer accounts. At that stage, it said it had not detected unauthorized access to customer models, datasets, training data, personal information or inference traffic within its security perimeter. It began notifying affected customers on 7 October and published a bulletin on 9 October.
We identified a security incident involving unauthorized use of internal Fireworks credentials. We contained the incident, revoked the credentials, and notified all identified affected customers directly.
— Lin Qiao (@lqiao) October 10, 2026
Our investigation is ongoing. We are working with a cybersecurity firm
CEO Lin Qiao’s full post said Fireworks had not detected impact or access to customer data or inference traffic at that time, and linked the original bulletin.
The Monday update describes further activity. A third-party cloud provider that hosted Fireworks research and development machines experienced a security incident on 23 October. On 24 October, Fireworks says, the unauthorized third party used that incident to reach Fireworks development machines and run an unauthorized workload that led to additional customer-data impact. Fireworks says it detected the activity the same day, took remediation measures and closed known critical vulnerabilities. As of 25 October, it says it had not detected further successful unauthorized access by the actor on the platform customers use.
| Date | What Fireworks says happened |
|---|---|
| 6 October 2026 | Identified unauthorized use of internal credentials; began containment |
| 7–9 October | Began notifying affected customers; rotated employee API keys; published first bulletin |
| 10 October | Revoked additional user API keys and rotated service-account tokens |
| 23 October | Third-party cloud provider hosting Fireworks R&D machines had a security incident |
| 24 October | Unauthorized party reached Fireworks development machines and ran a workload; Fireworks detected it the same day |
| 25 October | No further successful unauthorized access detected on the customer platform, Fireworks says |
| 9 November | Published update covering billing data and, for limited accounts, datasets and incomplete model weights |
LLMJacking and what Fireworks has done
Fireworks says the evidence links the activity to a financially motivated cybercriminal group aiming to sell tokens from unauthorized LLM access through illicit routing gateways, a pattern known as LLMJacking. It points readers to a 2 November post by Google Threat Intelligence Group and Mandiant on that market. The Google/Mandiant research describes broader LLMJacking cases elsewhere; Fireworks does not publish its own loss figures in the bulletin.
The company says it notified law enforcement and brought in Palo Alto Networks Unit 42 for forensic analysis. Hardening steps listed in the update include revoking and replacing credentials and service accounts, removing unnecessary elevated privileges, restricting unauthorized network pathways, isolating affected systems, tightening access to storage and analytics systems, and enhancing logging and monitoring.
While the investigation continues, Fireworks has disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training. Training SDK remains available with zero data retention, and Lab-based training, Fireworks says, runs in an isolated environment with extra network and storage protection.
Customers named in reporting
Palazzolo’s post and The Information‘s public homepage summary say Fireworks told large customers including Harvey in the past week, according to two people with knowledge of the breach, and that some customers who spend millions of dollars a year are considering switching providers. Sulat could not read the full paywalled article body.
Fireworks says a new hack exposed customer billing information, model weights and datasets.
— The Information (@theinformation) November 9, 2026
The breach comes as the startup, with $1 billion in annualized revenue, prepares a fundraise that could value it at $30 billion or more.
Full story: https://t.co/xZFCawlDiJ
Bloomberg Law reported that a Fireworks spokesperson said the company is “actively working with our customers to manage the incident, including Notion, Cursor and others.” Bloomberg Law also wrote that Fireworks has more than 10,000 customers, including Harvey, Notion and Cursor, according to the company’s customers page. That page lists Harvey, Notion and Cursor among public case studies; it does not, by itself, confirm which accounts were notified or whose datasets were accessed.
NEW: Fireworks is working with Notion, Cursor and other customers to contain a security incident involving compromised customer data — marking its second breach in just weeks.
— Natasha Mascarenhas (@nmasc_) November 9, 2026
https://t.co/h9JyOs7Yf6
Forbes, in reporting by Anna Tong and Rashi Shrivastava, said two customers told the magazine they had substantially moved their business off Fireworks’ systems. One described a series of “very bad hacks” and criticized Fireworks’ customer communications. Two other customers told Forbes they were not aware of any Fireworks hacks. Forbes also listed Uber, Shopify, Upwork, DoorDash, Cursor and Cognition among Fireworks customers.
New: Popular open source provider Fireworks has had its customer data and AI models hacked. One customer described a series of ‘very bad hacks’ and poor communication from @FireworksAI_HQ (w/ @RashiShrivast18) and said they were moving off the platform.
— Anna Tong (@annatonger) November 9, 2026
https://t.co/eeMxTJeeSm
Neither Harvey, Notion nor Cursor had issued a public statement Sulat could verify when this draft was prepared. Fireworks’ company X account had not posted about the Monday update in the posts retrieved for this reporting.
What Fireworks is, and the money claims
Fireworks hosts and fine-tunes open-weight models for developers and enterprises. In July, it announced a $1.505 billion Series D at a $17.5 billion valuation, led by Atreides Management, Index Ventures and TCV, with Nvidia among the participants. In the same post, Fireworks said it had passed $1 billion in annualized revenue run rate. Palazzolo’s “most highly-valued” framing for inference providers is her characterisation; Sulat has not independently ranked peer valuations. The Information‘s headline language about a “$1 billion business” matches Fireworks’ own ARR claim rather than the $17.5 billion equity valuation. The publication’s X account separately said Fireworks is preparing a fundraise that could value it at $30 billion or more; that figure is attributed to The Information‘s reporting and is not confirmed in Fireworks’ public Series D post.
What remains open
Fireworks has not published a public count of affected accounts, named which customers’ datasets or incomplete model weights were accessed, or identified the third-party cloud provider that hosted the R&D machines. It has not said whether any accessed model weights have appeared outside its systems. The company says customers with impact are receiving direct notices, and that anyone who has not received a notice has not been identified as affected based on the investigation to date. Contact for notices is listed as [email protected].
Discover more from Sulat AI & Tech News
Subscribe to get the latest posts sent to your email.
