Fireworks AI discloses breach of development machines after cloud provider hack
Fireworks has disclosed that attackers accessed its development machines after breaching a third-party cloud provider, according to BleepingComputer.
Written by a model from the sources below. Verify against them.
- Vendor
- Fireworks AI
- Status
- Confirmed
- The Hacker News: “In a notice published on October 10, 2026, the company said it detected unauthorized use of internal Fireworks credentials that allowed an unauthorized…”
- Oct 10, 2026
- Data taken
- Home addresses, Tokens and keys
- The Hacker News: “In a notice published on October 10, 2026, the company said it detected unauthorized use of internal Fireworks credentials that allowed an unauthorized third-p…”
- Stolen credentials, Third-party vendor
- The Hacker News: “The activity is assessed to be part of an emerging threat known as LLMjacking , which refers to the act of hijacking a victim's LLM through stolen credentials…”
- LLMjacking
Summary
The reporting does not say what data, if any, was taken.
What to do
Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it
For tokens and keys (certain affected accounts)Expect phishing that uses this breach; verify messages that mention it
For home addressesRotate API keys and secrets that were used with Fireworks
Review account and API activity logs for unexpected access
Enable multi-factor authentication on Fireworks console accounts
Watch for further updates from Fireworks on the scope of the breach
Review account and billing records for unfamiliar activity or charges
Check whether your datasets or models were stored on the platform and assess exposure
Timeline
- Discovered
The Hacker News: “The activity was detected on October 6, 2026, at 9 a.m. PDT.”
4 days - Made public by Fireworks AI
The Hacker News: “In a notice published on October 10, 2026, the company said it detected unauthorized use of internal Fireworks credentials that allowed an unauthorized…”
30 days - Reported by BleepingComputer
- First seen by cve.now1 day
- Confirmed by Fireworks AI
The Hacker News: “Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month uncovered further malicious activity, affectin…”
- Record last updated
What was taken
| Taken | Per the source |
|---|---|
| Home addresses | BleepingComputer: “In the new breach, the threat actors accessed resource metadata (e.g., Fireworks resource identifiers, display names, descriptions, creation time), billing inf…” |
| Tokens and keys (certain affected accounts) | The Hacker News: “At that time, the AI infrastructure provider said it only found evidence that environment variables, including API keys and tokens stored as secrets, were capt…” |
Evidence 16
- Social
- SocialHacker News
“Fireworks AI Hacked”
- SocialBluesky
“Fireworks AI tells customers including Notion and Cursor of an Oct. 24 data breach, its second known hack in weeks”
- Social
- Social
Show all 16 sourcesShow fewer sources
- SocialHacker News
“Fireworks AI security breach impacts Notion and their customers”
- PressBleepingComputer
“AI infrastructure startup Fireworks has disclosed a new security breach in which attackers accessed its development machines after breaching a third-party cloud provider.”
- SocialMastodon
“Fireworks AI disclosed a customer data breach originating from a compromise at its cloud host.”
- Social
- SocialBluesky
“Fireworks AI Hit by LLMJacking Cyberattack Exposing Customer Data and AI Model Weights”
- SocialMastodon
“Fireworks AI confirmed attackers stole up to 7.69% of customer model weights via IAM role chaining.”
- SocialMastodon
“Attackers compromised a third-party cloud provider, pivoted into Fireworks' R&D environment, escalated cloud privileges, and accessed customer datasets, secrets, billing information and incomplete model weights.”
- PressThe Hacker News
“Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month uncovered further malicious activity, affecting account and billing information, alongside secrets, datasets, and incomplete models for a "limited set of accounts."”
- SocialMastodon
“Notion is telling customers their AI chat transcripts surfaced in the Fireworks AI breach: fewer than 1% of workspaces, in most cases unattributable, no tool-call results.”
- SocialMastodon
“On Oct. 23, attackers reached development machines through an unnamed third-party cloud provider; an unauthorized workload ran the next day, leading to additional customer data impact.”
- SocialBluesky
“Fireworks AI says attackers accessed its development environment and affected a limited set of customer accounts, exposing account and billing information, secrets, datasets and incomplete models.”
Corrections
- Changed “Tokens and keys of some customers were exposed” to “Tokens and keys of a limited number of accounts were exposed”.
- Changed “Home addresses were exposed” to “Home addresses of some customers were exposed”.
- Changed “Tokens and keys of a limited number of accounts were exposed” to “Tokens and keys were exposed”.
- Changed “Tokens and keys were exposed” to “Tokens and keys of some customers were exposed”.
- Changed “Tokens and keys of some customers were exposed” to “Tokens and keys of certain affected accounts were exposed”.
- Changed “Tokens and keys of certain affected accounts were exposed” to “Tokens and keys of a limited number of accounts were exposed”.
- Changed “Home addresses of some customers were exposed” to “Home addresses were exposed”.
- Changed “Tokens and keys of a limited number of accounts were exposed” to “Tokens and keys of certain affected accounts were exposed”.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about the Fireworks AI breach
Was Fireworks AI breached?
Yes. Fireworks AI says so: “Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month uncovered further malicious activity, affecting account and billing information, alongside secrets, datasets, and incomplete models for a "limited set of accounts."” (The Hacker News).
What data was exposed?
Home addresses, Tokens and keys (certain affected accounts).
What should Fireworks AI customers do?
Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it. Expect phishing that uses this breach; verify messages that mention it. Rotate API keys and secrets that were used with Fireworks. Review account and API activity logs for unexpected access. Enable multi-factor authentication on Fireworks console accounts. Watch for further updates from Fireworks on the scope of the breach. Review account and billing records for unfamiliar activity or charges. Check whether your datasets or models were stored on the platform and assess exposure.