Fireworks AI expands disclosure of October breach to include model weights and secrets

Fireworks AI updated its security bulletin on November 9, 2026, disclosing that a breach at a third-party cloud provider let attackers reach its development systems, exposing billing data for all affected customers and, for a limited subset, incomplete model weights, datasets and secrets, according to the October 2026 Security Incident Update.

What changed in the updated bulletin

• The updated bulletin replaced a narrower version first published October 9, 2026.
• A third-party cloud provider hosting Fireworks' R&D machines was breached on October 23, 2026, and attackers reached Fireworks development systems the next day, October 24.
• Fireworks detected no further unauthorized access after October 25, 2026.
• Exposed data included resource metadata (IDs, names, descriptions, timestamps) and billing data (addresses, invoice and payment history, account balance, credit usage).
• For a limited subset of customer accounts, incomplete model weights, datasets and secrets were also exposed.
• Payment card numbers were not stored and were not impacted; Fireworks' Inference, Training SDK and Nexus products run zero-data-retention by default and were not impacted.

What it means for people who build with AI

Fireworks is a widely used inference and fine-tuning platform for teams running open-weight models in production, so exposure of model weights, datasets or secrets is a direct supply-chain risk. Fireworks says the attackers' motive was "LLMjacking": reselling unauthorized LLM API access through illicit gateways. This update is broader than the version published a month earlier.

Response and related reporting

Fireworks says it revoked and replaced credentials, isolated the affected systems, and disabled self-serve dataset upload and download during the investigation. The company also engaged Palo Alto Networks' Unit 42. Separately, Google and Mandiant published a related analysis of LLMjacking activity on November 2, 2026.

Sources

• October 2026 Security Incident Update (Fireworks AI, November 9, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.