Fireworks AI Was Breached Again Through a Cloud Provider, and This Time Datasets and Model Weights Were Hit

Fireworks AI has had to widen its story about October. The Nvidia-backed inference startup now says an attacker got in a second time through a third party cloud provider that hosted its research machines, and walked away with far more than the API keys it first disclosed.

In an updated security bulletin published Monday, Fireworks said the provider was compromised on October 23. The next day, the attacker used that foothold to reach Fireworks development machines and run an unauthorized workload. Fireworks says it caught the activity the same day and has seen no further successful access to its customer platform since October 25. It has not named the provider or said how many customers are affected.

From secrets to billing data and weights

The first incident, disclosed on October 9, looked contained. Attackers had misused internal credentials and read environment variables in evaluation jobs, including some customers' API keys and tokens, and Fireworks said at the time it saw no access to models, datasets or personal information.

The new bulletin reverses much of that. The compromised internal application gave access to resource metadata and to billing information, including billing and shipping addresses, invoice and payment history, account balances and credit usage. For a limited set of accounts, the attacker also reached stored secrets, datasets and a subset of incomplete model weights. Card numbers were not exposed because Fireworks does not store them.

CEO Lin Qiao has pushed back on the idea that weights were the target, telling The Register that most downloads were partial and stopped.

An LLMjacking crew

Fireworks ties the activity to a financially motivated group that steals access to large language models and resells it through illicit routing gateways, a practice known as LLMjacking. Palo Alto Networks' Unit 42 is helping with the investigation. Fireworks says its Inference, Training SDK and Nexus products show no impact, since all three keep no customer data by default.

As part of the cleanup, Fireworks revoked and replaced credentials and service accounts, isolated the affected systems and tightened access to its storage. It has also switched off self-serve dataset uploads and downloads for Batch Inference and dataset-based training while the investigation continues.

Fireworks was already on Wiz's list of AI developer platforms hit in October, alongside the Northflank breach and Railway. Fireworks is telling customers to rotate their API keys and any secrets stored on the platform. Deleting a stored secret does not revoke the credential behind it, so it has to be changed at the source.

Some offers on this page may be paid placements or contain affiliate links.