🔍 Read the full analysis: Fireworks AI Breach Expands: Questions For Security Teams on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Fireworks AI’s November 9 update says an October security incident affected account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. The company describes two routes of access, including a later intrusion through an unnamed cloud provider; Notion says transcripts from its AI Insights feature may have been in an accessed dataset.
Fireworks AI said on November 9 that its October security incident affected more information than it had initially reported, including account and billing details and, for a limited set of accounts, secrets, datasets and incomplete models. The AI platform provider also described a later intrusion through a third-party cloud provider that hosted its research and development machines, broadening the incident’s scope for customers using its services.
Fireworks’ October 9 bulletin said an attacker had used internal credentials to read environment variables from a limited number of customer evaluation jobs. At the time, the company said it had not detected unauthorized access to customer models, datasets, training data, inference traffic or personal information. Its November update revised that account: Fireworks said it had since discovered impacts to account and billing information, as well as secrets, datasets and incomplete models for some accounts.
The company described a second access route. A third-party cloud provider hosting Fireworks R&D machines had a security incident on October 23, according to Fireworks. The following day, an unauthorized party used that access to reach development machines and run an unauthorized workload that led to additional customer data impact. Fireworks said it detected the activity on October 24 and has not detected further successful access by the threat actor to the platform customers use since October 25.
Fireworks listed exposed information as resource metadata, billing and shipping addresses, invoice and payment history, account balances and credit usage. For certain customers, it said, a subset of incomplete model weights and datasets was accessed. It did not explain what “incomplete” means or specify how many customer accounts were affected. The company said it does not store payment card numbers and that those were not impacted. It also said it had detected no impact to Inference, Training SDK or Nexus, which it describes as zero-data-retention by default.
Fireworks AI Breach Expands:Questions for Security Teams
Fireworks AI’s November 9 update broadened the reported impact of an October incident. Customers must assess which data and assets may have been involved while the investigation continues.
What may have been affected
Fireworks reported account and billing impacts, plus additional data for a limited set of accounts.
Billing and resource details
Reported information included metadata, addresses, invoice and payment history, balances and credit usage.
Secrets and model assets
Fireworks said secrets, datasets and incomplete model weights were affected for some accounts.
AI Insights transcripts
Notion said transcripts were in a dataset attackers may have accessed; this does not establish that every transcript was accessed.
Two routes of access
Fireworks’ October 9 bulletin described access to environment variables from a limited number of customer evaluation jobs.
After an October 23 incident at an unnamed provider hosting R&D machines, an unauthorized party reached development machines and ran a workload on October 24.
What teams should investigate
The reported exposure creates questions for customers; the supplied updates do not confirm misuse of accessed material.
- Which accounts, datasets, secrets or unfinished model assets may be involved?
- Do any credentials need rotation, and were affected assets used elsewhere?
- Could proprietary training material have been present in the affected datasets?
Service and scope gaps
- Payment card numbers were not stored and were not impacted.
- No impact detected to Inference, Training SDK or Nexus.
- Dataset uploads and downloads for Batch Inference and dataset-based training are disabled during investigation.
- Number of affected customers and accounts.
- Identity of the cloud provider and how initial credentials were obtained.
- Whether accessed material was copied, retained, shared or used.
- When disabled functions will return.
Risks for AI Platform Customers
The disclosure matters because Fireworks runs and fine-tunes open AI models for businesses, placing it between its customers and data used to build or operate AI products. Exposure of datasets, secrets or model weights could create risks beyond routine account or billing exposure: customers may need to determine whether proprietary training material, credentials or unfinished model assets were involved. The source does not establish that attackers used or published any of the accessed material.
The incident also shows why customers may need to review security events at service providers and their providers in turn. Fireworks says one route involved internal credentials and another involved a cloud provider’s R&D environment. For organizations relying on third-party AI infrastructure, the practical questions include which data was present, whether credentials require rotation, and whether any affected assets were also used elsewhere. Those are questions for investigation, not confirmed consequences in this case.
Fireworks has disabled self-service dataset uploads and downloads used by Batch Inference and dataset-based training while it investigates. That precaution may affect customers’ ability to use those functions. The company has not given a timeline for restoring them.
Popular right now
Apple AirPods Pro (1st Generation) with MagSafe Charging Case
KitchenAid Artisan Mini 3.5-Qt Tilt-Head Stand Mixer, Candy Apple Red
Dyson V15 Detect Cordless Vacuum
As an affiliate, we earn on qualifying purchases.
From October Bulletin to Broader Update
Fireworks said it identified the initial activity on October 6 and began containment. It started notifying affected customers on October 7, published its first bulletin on October 9, and said it rotated employee API keys and later revoked additional user API keys and rotated service-account tokens. The first bulletin described the matter as limited and said the company had found no evidence of access to several categories of customer data.
The later cloud-provider incident occurred on October 23, followed by the unauthorized workload on October 24. Fireworks’ November 9 update came more than a month after its first detection and added the newly identified data impacts. Fireworks said it notified law enforcement and engaged Palo Alto Networks Unit 42 for forensic work.
Notion, a Fireworks customer, said it was notified in stages between November 2 and November 8. The company said transcripts from its Notion AI Insights feature were in a dataset attackers may have accessed, and put the share of affected workspaces at fewer than 1%. That figure is Notion’s statement about its own workspaces, not a total count of Fireworks customers or affected accounts.
“For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models.”
— Fireworks AI, November 9 security update
Scope and Data Handling Still Unknown
Fireworks has not named the third-party cloud provider, said how many customers or accounts were affected, or explained how the internal credentials used in the first access were obtained. The company has also not said whether the accessed datasets, secrets or model material were copied, retained, shared or otherwise used by the attackers. These details remain unresolved in the supplied updates.
The description of the model weights as “incomplete” is not defined, and the company has not detailed what data was present in the affected customer datasets. Notion’s statement identifies possible exposure of AI Insights transcripts in a dataset, but does not establish that every transcript in an affected workspace was accessed. Fireworks says its investigation is ongoing and may reveal additional information.
Forensic Review and Customer Notices
Fireworks says it is continuing its investigation with Unit 42 and has notified law enforcement. Customers can expect the company’s findings and any further notices to clarify the affected accounts, data categories and response steps, but no publication date for a final report is stated in the supplied material.
In the meantime, Fireworks says the dataset upload and download functions used for Batch Inference and dataset-based training remain disabled as a precaution. The company has not announced when those services will return. The next confirmed development will be any further update from Fireworks or customer-specific notices that add detail about exposure and remediation.
Key Questions
What did Fireworks AI say was affected?
Fireworks said the incident affected account and billing information. For a limited set of accounts, it also reported impacts to secrets, datasets and incomplete models. It listed resource metadata, addresses, invoice and payment history, account balances and credit usage among the information involved.
Were payment card numbers exposed?
Fireworks said it does not store payment card numbers and that they were not impacted. The company did report impacts to other billing information, including addresses and invoice and payment history.
What did Notion disclose?
Notion said transcripts from its AI Insights feature were in a dataset attackers may have accessed. It said fewer than 1% of workspaces were affected; that figure refers to Notion workspaces and does not describe the total Fireworks incident.
Has Fireworks said how many customers were affected?
No total number is given in the supplied update. Fireworks describes some impacts as affecting a “limited set” of accounts but has not published an overall customer or account count.
What remains unknown about the intrusion?
Fireworks has not named the cloud provider, explained how the internal credentials were first obtained, or said what happened to accessed data. It says the investigation is ongoing and could produce more information.
Source: ThorstenMeyerAI.com
