Fireworks AI gets burned twice as customer data exposure widens

Inference biz pins latest breach on cloud provider and LLMJacking miscreants

Fireworks AI has disclosed another cyberattack in October and a wider customer data exposure involving billing records, datasets, and incomplete model weights.

The company, which lets customers train and run AI models, said a third-party cloud provider hosting its research and development machines was compromised on October 23. Attackers used that access the following day to reach Fireworks development systems and run an unauthorized workload.

Fireworks suspects links to financially motivated criminals involved in LLMJacking – selling unauthorized access to AI models through illicit gateways.

REG AD

Fireworks grouped the affected data into three categories:

REG AD

• Resource metadata: Resource identifiers, display names, descriptions, creation times, and more

• Billing information: Billing and shipping addresses, invoice and payment histories, account balances, and credit usages. Payment card numbers are not saved and therefore unaffected

• Model weights and datasets: For certain customers, a subset of incomplete model weights and datasets were accessed, Fireworks said

Lin Qiao, Fireworks co-founder and CEO, said the apparent motive was not stealing model weights in response to concerns raised by Cantina Security CEO Hari Mulackal.

"From what we see attackers are not after weights," said Qiao. "Most downloads were partial and stopped."

Render founder and CEO Anurag Goel shared a notification from Notion warning that some chats with its AI assistant may have been exposed through the Fireworks incident.

"Following an investigation by the Notion security team, we have determined that your workspace, Render, was among the <1 percent of Notion workspaces that may have been affected by the Fireworks security incident," the email sent to Goel stated.

"Some unattributable chat sessions with Notion AI may have been exposed in this incident."

Notion said the exposed transcripts lacked separate information linking them to particular users or workspaces. As Reddit users pointed out, however, the conversations themselves could contain identifying details.

"Beyond what's in the chat transcript itself, there's no information tying the chat back to your workspace, users, or company," the email added. "No other data from within your workspace is affected."

REG AD

Bloomberg reports that Fireworks is also working with customers including Cursor and Harvey to assess the impact.

Fireworks' update confirmed that it worked with Palo Alto Networks' Unit 42 team to remediate the attack, which included rotating credentials, isolating affected systems from the network, and tightening up data storage access and monitoring systems.

The update did not state how many customers were affected by either of the two attacks in October.

Fireworks first disclosed an incident on October 9 after detecting unauthorized use of internal credentials on October 6. Attackers accessed environment variables in evaluation jobs, including API keys and tokens belonging to some customers.

At the time, Fireworks said it had found no evidence of access to models, datasets, training data, inference traffic, or personal information. Monday's update substantially broadens the disclosed impact. ®