Fireworks AI Breach: What Was Exposed and What to Do Now

Fireworks AI first said its October breach touched stored secrets, not customer models. On November 9, 2026, it widened that story. The Fireworks update now lists billing records for its users and, for a limited set of accounts, secrets, datasets and incomplete model weights.

More than 10,000 companies use Fireworks, according to its own site. If your team fine-tunes models or stores keys on any AI platform, this Fireworks AI breach is worth a close look.

Key Takeaways

• The scope grew. In October, Fireworks found no sign that models or datasets were touched, but its November 9 update says some of them were.
• There were two ways in. First came misused internal credentials on October 6. Then, on October 24, an attacker came through a cloud provider that hosts Fireworks' R&D machines.
• Inference looks clean. Fireworks says Inference, Training SDK and Nexus show no impact.
• It's part of a wave. Wiz counted nine AI developer platforms with incidents in October alone, and every public report showed attackers hunting stored secrets, especially keys for AI models.
• Rotate at the source. Deleting a key on Fireworks doesn't kill it. Revoke it with the provider that issued it.

Fireworks AI Breach at a Glance

The core facts, as of November 11, 2026:

How many accounts? The Register noted the update gave no count for either attack. Bloomberg, citing a person familiar with the matter, reported that the intrusion included tens of thousands of files, some of which held customer data.

What Changed in the November 9 Update

The first Fireworks bulletin, published October 9, described a narrow problem. Someone used internal credentials to read settings in eval jobs. In some accounts, those settings held API keys and tokens stored as secrets.

At the time, Fireworks saw no evidence of access to customer models, datasets or training data. The November update walks that back.

Three things are new:

• A second entry point. It's a third-party cloud provider that hosts Fireworks' research machines, and Fireworks hasn't named it.
• More data types. Billing, shipping and payment history for its users were hit.
• Model work. Datasets and incomplete model weights were reached in some accounts.

Fireworks treats this as one incident. Bloomberg and The Register call it a second hack. The label matters less than the new list of what to check.

Fireworks AI Breach Timeline

Here's the sequence, built from the two Fireworks bulletins and press reports:

The gap between October 24 and November 9 is worth noting. Fireworks says it spotted the October 24 attack the same day. It then took 16 days to publish the wider scope, while forensic work with Palo Alto Networks Unit 42 went on in the background.

Some delay is normal. But customers who read only the October bulletin had no reason to check their datasets. That's costly.

What Data the Fireworks AI Breach Exposed

The update splits the data into two groups. Billing data isn't limited to a named set. Secrets, datasets and model weights touch a smaller, named set of accounts.

The billing data is the part most likely to fuel phishing. Real addresses and invoice history make a fake "billing problem" email look real. Warn your finance team now.

The model data carries the most long-term risk, because a tuning dataset can hold customer records, support chats or internal files. Even a partial copy can leak what a firm knows.

What about the weights? CEO Lin Qiao pushed back on that worry on X. "From what we see attackers are not after weights," she wrote, The Register reported. She added that most downloads were partial and stopped.

The data hit reached at least one big name. The Register cited an email from Notion to a customer, which said under 1% of Notion workspaces may have been affected. It also said some unattributable Notion AI chat sessions may have been exposed.

How Attackers Got In

There were two ways in:

The first started with internal credentials, and Fireworks still hasn't said how they were stolen.

The second came through the supply chain. A cloud provider that hosts Fireworks R&D machines had its own incident on October 23, and a day later the attacker used that foothold to reach Fireworks dev machines.

That second path is the hard lesson. You can vet your AI platform and still be exposed through a vendor of that vendor.

Why Attackers Want AI Keys: LLMjacking

Fireworks says the evidence points to a financially motivated group aimed at selling tokens. That practice is known as LLMjacking. Criminals steal keys for AI models, then resell cheap access to others.

It's a simple business. A stolen key for a frontier model is resold for a fraction of list price, and the victim pays the bill.

Wiz traced stolen keys on Amazon Bedrock. Here's how it played out, per Wiz:

1. Fast check: within 30 minutes
2. Quiet use: a few small test calls a day from the same small client, for several days in a row, so nothing looked odd on the bill
3. Bulk abuse: about 800,000 calls over 30 hours on one key
4. The bill: two keys likely ran up over $100,000 at list price

Wiz also says demand for distillation, or training a cheap model on a strong model's answers, drives some of this theft.

Black October: Nine Platforms in One Month

Fireworks wasn't alone. Wiz's report, published October 30, 2026, counted at least nine AI developer platforms that disclosed incidents that month. It called the run "Black October."

Wiz says all the public reports show attackers hunting stored settings. They wanted the ones that grant AI access. It also says no single bug or shared dependency links them. So there's no one patch.

Entry points ranged from stolen credentials at Fireworks, Zeabur and Lightning AI to build systems at Railway and a third-party vendor at Warp.

Wiz has since added more names, including Brev, Trigger.dev and Chainstack, and a second Fireworks incident. Two resale groups had the stolen keys. Wiz can't tie them to the break-ins.

Why the Fireworks AI Breach Hits Data Teams Hardest

Most coverage of this wave is about API keys. For data teams, the Fireworks AI breach is different, because fine-tuning platforms hold more than keys.

To tune a model, you upload a dataset. That file often comes straight from a warehouse. It may hold personal data, even when you meant to strip it.

So the Fireworks AI breach raises questions that most key leaks don't:

• Privacy: did the dataset hold customer personal data?
• Contracts: do they limit who may process that data?
• Rules: does a leak trigger a notice duty under GDPR or state law?
• Strategy: what could a rival learn from your labels, your prompts or the way your support team answers hard customer questions?

Don't wait for Fireworks' final numbers. You know which datasets you uploaded.

Were You Affected by the Fireworks AI Breach?

Fireworks says it's notifying affected customers directly, with steps to take. Its October bulletin says that if you didn't get a notice, no incident-specific action is needed.

Check four places anyway:

• Your inbox. Search for notices from Fireworks since October 7, including spam folders.
• Your console. Look for API keys, users, evaluators, training jobs or datasets you don't recognize, and send Fireworks the names or IDs of anything odd.
• Your provider bills. Look for spikes on any key you ever stored on Fireworks.
• Your vendor list. Check whether any other tool you use appears in Wiz's Black October list.

Not sure what you stored? Fireworks says it can share secret names and credential fingerprints through a secure channel.

What to Do in the Next 7 Days

Run this plan this week, notice or not. Days 1 and 2 are about keys and money:

1. List your secrets: every API key, token and password you ever stored on Fireworks or any other Black October platform, including old ones you think are dead
2. Rotate AI provider keys and other secrets at the source
3. Check bills from OpenAI, Anthropic, AWS and others for spend you can't explain
4. Set hard caps on spend and rate for every AI provider account

Days 3 to 7 are about data and habits:

5. Review uploads: list each dataset you sent for tuning
6. Call legal if any of it held personal data
7. Warn finance and support to expect billing-themed phishing that uses real invoice details
8. Fix the pattern: move secrets into a vault and scope each key to one job

Step 2 is the one teams skip. The Cloud Security Alliance stresses that you must revoke keys at the issuing provider. Deleting it on Fireworks isn't enough.

Should You Leave Fireworks?

Some customers already have. Forbes spoke with two who had moved most of their work off the platform.

Fireworks is still a big player. Bloomberg says it was valued at $17.5 billion in July, and Nvidia and AMD are among its backers. A spokesperson said it's working with customers, including Notion and Cursor, to manage the incident.

Our view: don't decide on headlines. A move costs time, means retesting every model and prompt you run, and brings its own risks with a new vendor. Ask Fireworks three things first:

• Which of our accounts and assets were accessed?
• What has changed?
• When will the root cause report come out?

If the answers are vague, plan a second provider. That's good practice anyway, breach or not.

Worked Example: What a Leaked Key Can Cost

Here's our own math on a simple case, using Wiz's Bedrock numbers.

In Wiz's first case, one key made about 800,000 calls in 30 hours. That's roughly 26,700 calls an hour. About seven a second. At that pace, a key leaked on a Friday evening could run all weekend before anyone looks.

Wiz says its two cases likely cost over $100,000 at list price, so compare that with a daily spend cap of $500.

Over a three-day weekend, the most a stolen key could spend is $1,500. The cap won't stop the theft. It caps the damage.

The other cost is time. Rotating one key takes minutes. Rotating 30 keys across five tools, with no list of where they live, can take days.

Lessons From the Fireworks AI Breach for Vendor Checks

Use these when you review any tool that holds your keys or data:

One habit helps most: never give a platform a key with more power than one job needs.

Last week's Claude Code secrets leak showed keys escaping through local files. For the wider picture on agent risk, see our guide to agentic AI security.

What to Watch Next

A few things will show how serious this gets:

• A root cause report from Fireworks and Unit 42.
• The cloud provider's name, and whether any of its other customers, inside or outside the AI world, were hit too.
• Account counts for datasets and weights.
• Regulator interest, since billing data was involved.
• More Black October names as Wiz updates its list.
• Customer moves among the biggest names.

Fireworks AI Breach: Our Take

The Fireworks AI breach is less about one company than about a pattern. AI platforms gather keys, datasets and model weights in one place. Attackers noticed. Nine platforms in one month is not bad luck, and it won't be the last wave like this.

The harder issue is trust in first statements. Fireworks' October bulletin was too narrow, and customers acted on it. Treat any first notice as a floor, not a ceiling.

For most teams, the fix is boring and cheap:

• Keep a list of your secrets.
• Rotate at the source.
• Cap spend on every AI account.
• Delete datasets you don't need.

Do that now, and the next breach notice becomes a short task, not a crisis.

How Van Data Team Helps

We help data and AI teams lock down the platforms they rely on:

• Secret and key audits across AI platforms, CI and cloud accounts, through our system operations and maintenance service.
• Safer tuning pipelines that strip personal data before upload, via data pipeline development.
• Agent setups with scoped keys and spend caps, through AI agent development.
• AI spend dashboards that flag odd usage early, through agentic BI reporting.

This article is based on public statements and reporting as of November 11, 2026. It isn't legal advice. Worried about exposed keys or datasets? Get in touch and we'll help you work through the list.