Fireworks AI: attackers seeking to resell LLM access reached API keys, billing data and some customer models

How it happened

Fireworks' first bulletin describes "unauthorized use of internal Fireworks credentials", spotted on October 6; it does not say how the credentials were obtained. Its update adds that a third-party cloud provider hosting Fireworks R&D machines had a security incident on October 23, and that on October 24 the attacker used it to reach Fireworks development machines and run an unauthorized workload. The provider is not named, and Fireworks does not say whether the two paths are linked.[1][2] Checked 13 Nov 2026

What was stolen

Environment variables, including API keys and tokens stored as secrets, in certain affected accounts. Since then Fireworks found impact on resource metadata and billing information (billing and shipping addresses, invoice and payment history, account balance, credit usage), and, for certain customers, a subset of incomplete model weights and datasets. Fireworks says it does not store payment card numbers and detected no impact on Inference, Training SDK or Nexus.[1][2] Checked 13 Nov 2026

Who was impacted

"A limited number of customer accounts" in the first bulletin; the update says Fireworks is notifying the customers whose data was impacted. No number is given. Customers were told to replace revoked keys and rotate third-party credentials with their issuers. Self-serve dataset uploads and downloads for Batch Inference and dataset-based training are disabled during the investigation. Among downstream customers, Notion says Notion AI chat transcripts from "fewer than 1% of Notion workspaces" were affected. Uber is notifying drivers that personal and driver's license information was taken through Fireworks; breach notices list 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island, and Uber gives no total. Cursor says an access key it had issued to Fireworks was exposed by Fireworks and used against it (see the Cursor entry).[1][2][3][4][5][6][7] Checked 14 Nov 2026

Threat actor

Not attributed. A financially motivated cybercriminal group that sells tokens from unauthorized access to LLMs ("LLMJacking"), according to Fireworks. The group is not named.

Timeline

1. 6 Oct 2026Fireworks identifies the activity and begins containment. [2]
2. 9 Oct 2026Fireworks rotates employee API keys, notifies the affected customers it has identified and publishes a bulletin. [2]
3. 10 Oct 2026Fireworks revokes more user API keys and rotates service-account tokens found in a credential review. [2]
4. 23 Oct 2026A third-party cloud provider hosting Fireworks R&D machines suffers a security incident. [1]
5. 24 Oct 2026The attacker uses that incident to reach Fireworks development machines and run an unauthorized workload; Fireworks detects and responds the same day. It says it saw no further successful access to its customer platform from October 25. [1]
6. 9 Nov 2026Updated bulletin: impact widened to account and billing data and, for some customers, datasets and incomplete models. Law enforcement notified, Palo Alto Networks Unit 42 engaged, and the attackers linked to an LLMJacking group. [1][3]
7. 9 Nov 2026Notion says Fireworks, one of its AI vendors, told it on November 2 that a small set of data, Notion AI synthetic test data, had been accessed; Notion disconnected from Fireworks and deleted its data there by November 3. Fireworks then said on November 6 that customer data may have been accessed and confirmed it on November 8: Notion AI chat transcripts used for its Insights feature, mostly not labelled with an author or workspace. Notion says its own systems were not breached, paused Insights and advises rotating any credentials pasted into Notion AI during the period. [4]
8. 10 Nov 2026Uber's breach notice to drivers, filed with the California attorney general, says a service provider told Uber on October 9, 2026 that an unauthorized third party had compromised the service, and that Uber's investigation found on October 13 that the party had used compromised credentials. Uber offers free credit monitoring and fraud assistance. [5]
9. 13 Nov 2026Uber tells TechCrunch the notices relate to "a security incident impacting one of our third-party vendors, Fireworks.ai", which had access to some Uber data. Notices seen by TechCrunch cover driver's license data of 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island, with the Illinois count pending. [5][6]
10. 13 Nov 2026Cursor says an attacker obtained an access key Cursor had issued to Fireworks, "exposed by Fireworks", and used it to open a shared bucket of coding agent traces; that led to the tampered Claude Code extension served by Cursor's marketplace on October 29. Cursor has moved all its inference traffic off Fireworks. [7]