The breach Fireworks AI disclosed in October was supposed to be contained. It wasn't. In an update published Monday, the AI infrastructure startup said its investigation found the intruders reached far more than the stored secrets it first reported: account and billing information, and — for a limited set of customers — datasets and incomplete model weights. That's the raw material of other companies' AI products, sitting in the hands of a financially motivated crew.
The timeline now has two separate intrusions inside one month. Fireworks first detected unauthorized use of internal credentials on October 6 and published its initial bulletin on October 9, saying only stored secrets, including ones used in evaluation jobs, had been accessed. The second path came through the back door: a third-party cloud provider hosting Fireworks' research machines had its own security incident on October 23, and the next day the intruder used that opening to reach Fireworks' development machines and run an unauthorized workload. Fireworks says it caught the activity the same day and has detected no further successful access on its customer platform since October 25.
What was taken depends on whose account you had. The affected records include resource metadata and billing details — addresses, invoices, payment history, balances, credit usage — plus, for some customers, secrets, portions of datasets, and unfinished model weights. Fireworks says it doesn't store payment card numbers, so those weren't touched, and it reports no detected impact on its Inference, Training SDK, or Nexus services, which are zero data retention by default. It has disabled self-serve dataset uploads and downloads for some batch and training workflows while the investigation continues, with Palo Alto Networks' Unit 42 handling forensics and law enforcement notified.
The motive, according to Fireworks, is the newest crime in the AI economy: "LLMJacking," selling unauthorized access to large language models through illicit routing gateways. Google's threat intelligence team and Mandiant described the scheme in research published November 2, and Fireworks' evidence points to a group running exactly that play — steal the keys and the compute, resell the access.
The customer list is what makes this one land. Fireworks counts more than 10,000 customers, and Bloomberg Law reported that Notion and Cursor are among those affected — two companies whose own products are built on the models Fireworks serves — and that the breach touched tens of thousands of files containing customer data. Bloomberg Law called it the company's second known hack in a matter of weeks; Fireworks frames it as a second intrusion path inside the same October investigation. Either way, it's the same uncomfortable fact.
And it's not an isolated incident. Security researchers at Wiz counted at least nine AI developer platforms disclosing breaches in October alone, most of them hunting for stored credentials and API keys. The Beta Bites covered one of them — OpenCode, whose users' provider keys were exposed — on October 19. The pattern is now unmistakable: attackers stopped going after the models and started going after the plumbing underneath them, where one vendor holds the keys, the datasets, and the half-finished weights for thousands of customers at once. Fireworks is the latest proof that the AI supply chain's weakest link isn't the model. It's whoever stores the model.
— via Fireworks AI