🔍 Read the full analysis: A Practical Guide To Checking Your Exposure To The Fireworks AI Breach on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Fireworks AI’s November 9 update says an incident first disclosed in October extended to account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. Notion separately said transcripts from its AI Insights feature may have been in an accessed dataset, affecting fewer than 1% of workspaces. Fireworks has not published a total number of affected customers or identified the cloud provider involved.
Fireworks AI said on November 9 that a security incident it first disclosed in October reached further than initially reported, including account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. The update gives customers new categories to check against their use of the platform, but does not state how many customers were affected.
Fireworks, which provides infrastructure for running and fine-tuning open AI models, described two paths into its systems. In the first, attackers used internal credentials to read environment variables from customers’ evaluation jobs. Such variables can contain API keys or other access tokens. In a later incident, an attacker used a security problem at an unnamed third-party cloud provider hosting Fireworks research and development machines to reach development machines and run an unauthorized workload on October 24. Fireworks said it detected that activity the same day.
The company’s November 9 update lists resource metadata, including identifiers and descriptions; billing information, such as billing and shipping addresses, invoice and payment history, account balances and credit usage; and, for certain customers, a subset of datasets and incomplete model weights. Fireworks said payment card numbers were not affected because it does not store them. It also said it had detected no impact to its Inference, Training SDK or Nexus products, which it described as zero-data-retention by default.
Fireworks said it began containing the first activity on October 6 and started notifying affected customers on October 7. It rotated employee API keys on October 9 and revoked additional user keys and rotated service-account tokens on October 10. It said it had detected no further successful unauthorized access by the threat actor on the customer-facing platform after October 25. The company said it notified law enforcement and brought in Palo Alto Networks Unit 42 to assist with forensic work.
Check your exposure to the Fireworks AI breach
Fireworks AI’s November 9 update expanded the reported scope of an October incident. Customers should compare the affected data categories with their platform use and watch for direct notices.
What may be involved
The update added account and billing information, plus limited exposure of technical materials.
Metadata and billing
Resource identifiers and descriptions, addresses, invoice and payment history, balances and credit usage.
Secrets and artifacts
Some secrets, datasets and incomplete model weights may have been accessed.
Payment card numbers
Fireworks says it does not store card numbers. It reported no impact to Inference, Training SDK or Nexus.
How the scope changed
The November update added categories that the October bulletin had not reported as accessed.
- Misused internal credentials accessed evaluation job environment variables.
- Fireworks said it had not detected access to customer models, datasets or personal information.
- Added account and billing information to the reported scope.
- Reported limited impact to secrets, datasets and incomplete models.
Checks for customers
Use your Fireworks notice and platform activity to assess whether your organization may be affected.
Check your Fireworks use and customer-specific notices against the reported materials.
Identify evaluation jobs, datasets and model training runs active during the relevant period.
Review secrets or tokens stored in job environments; consider replacing any potentially exposed credential still in use.
Follow direct Fireworks notices and review relevant access logs as the investigation continues.
What remains unclear
The available information does not establish whether a particular customer was affected.
- Fireworks has not disclosed a total number of affected customers.
- The third-party cloud provider has not been named.
- Whether accessed data was copied or used is unknown; the investigation is ongoing.
- Notion’s figure applies only to its own workspaces, not to Fireworks customers overall.
What Customers Should Check
The expanded scope matters because Fireworks serves as infrastructure used by other companies, not just as a standalone consumer application. Customers that used it for model development or evaluation may need to determine whether their credentials, data or model artifacts were among the affected materials. Access to a secret such as an API key can create risks beyond the original service if that credential remains valid elsewhere; whether any exposed secrets were used is not established in the available information.
For customers, the practical first step is to compare the affected categories in Fireworks’ notice with their own use of the platform and any customer-specific communication from the company. They can review which evaluation jobs, datasets and model training runs were active during the relevant period, and identify credentials or tokens that may have been stored in job environments. If a potentially exposed credential is still in use, the organization can assess whether to revoke or replace it and review relevant access logs. These are general security checks, not confirmation that a particular customer was affected.
The incident also shows why an initial notice should not be treated as a complete accounting when a provider says its investigation continues. Fireworks’ October bulletin said it had not detected access to several categories, including customer models and datasets. Its November update later reported impact to some datasets and incomplete models. Customers therefore have reason to follow subsequent notices, while distinguishing confirmed exposure from the possibility that their own account was involved.
Products Worth Considering
Bose Lifestyle Ultra Compact Wireless Smart Home Speaker Bundle, Black
Logitech MX Master 4 Ergonomic Wireless Mouse with Haptic Feedback, Graphite
Logitech MX Master 4 for Mac Wireless Ergonomic Mouse, White Silver
As an affiliate, we earn on qualifying purchases.
From October Notice to Update
Fireworks’ October 9 bulletin described misuse of internal credentials and access to environment variables in a limited number of customer accounts. At that time, the company said it had not detected unauthorized access to customer models, datasets, training data, inference traffic or personal information. The November update added account and billing information and limited access to secrets, datasets and incomplete models, changing the scope customers had been given.
The update also describes a separate development: a security incident at a third-party cloud provider on October 23, followed the next day by an unauthorized workload on Fireworks development machines. Fireworks has not named that provider. The company said it has disabled self-service dataset uploads and downloads used by Batch Inference and dataset-based training while its investigation proceeds.
Notion, a Fireworks customer, said some chat transcripts from its Notion AI Insights feature were included in a dataset that attackers may have accessed. Notion put the share of affected workspaces at fewer than 1%. It said Fireworks first contacted it about a small dataset on November 2, later warned on November 6 that potential customer data might have been accessed, and confirmed the dataset on November 8. That disclosure is specific to Notion and does not establish how many other Fireworks customers were affected.
“For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models.”
— Fireworks AI, November 9 security update
Scope and Data Use Still Unknown
Fireworks has not disclosed the number of affected customers, named the third-party cloud provider or explained how the internal credentials used in the first activity were initially obtained. It has also not said whether accessed data was copied, shared or used after access. The company’s description of model weights as “incomplete” is not accompanied by details about what was missing or how much of any model could be reconstructed.
Notion’s fewer-than-1% figure applies to its own workspaces, not to Fireworks customers as a whole. The source information does not identify which other organizations may have had datasets, secrets or model artifacts accessed. Fireworks has not named a threat actor; its update says evidence indicates links to a cybercriminal group, but the material provided does not identify that group or establish who was responsible.
Fireworks says it has not detected further successful unauthorized access to the customer-facing platform after October 25. That is a statement about its detection and investigation, not proof that no data was accessed or misused before then. Its investigation remains ongoing.
Customer Notices and Forensics
Fireworks says it is continuing its investigation with Palo Alto Networks Unit 42 and has notified law enforcement. Customers should watch for direct notices from Fireworks and any updates describing affected accounts or data categories. The company has not provided a date for a final report or said when the temporarily disabled dataset functions will return.
Organizations that used Fireworks can check the company’s incident communications, inventory relevant evaluation jobs and datasets, and review secrets or tokens placed in those environments. They can also examine access logs for suspicious activity and follow their established incident-response procedures if they find a potential exposure. These checks can help establish a customer’s own risk; the public update alone does not confirm that any specific account or credential was compromised.
Key Questions
What information does Fireworks say was affected?
Fireworks said the incident reached account and billing information, including addresses, invoice and payment history, balances and credit usage. For a limited set of accounts, it also reported access to secrets, datasets and incomplete model weights. It said payment card numbers were not stored or affected.
How can a Fireworks customer check for possible exposure?
Customers can compare their use of Fireworks with the categories in the November 9 update, review relevant evaluation jobs and datasets, and check whether credentials or tokens were stored in job environments. They should also consult any direct notice from Fireworks. The public information does not identify every affected account.
Were Notion AI transcripts included?
Notion said transcripts from its AI Insights feature were in a dataset attackers may have accessed. Notion said fewer than 1% of its workspaces were affected. That figure concerns Notion and does not describe the wider Fireworks customer base.
Were all Fireworks products affected?
Fireworks said it had detected no impact to Inference, Training SDK or Nexus, which it described as zero-data-retention by default. The company also said it disabled certain self-service dataset uploads and downloads while investigating. The investigation is ongoing, so customers should follow later company notices.
Source: ThorstenMeyerAI.com
