The Pulse
Fireworks AI incident affected customer data and incomplete models
The October security incident affected account and billing information, while a limited set of accounts also had secrets, datasets and incomplete model weights affected. Additional customer data impact was linked, the company says, to an un
AI.info Team · Written with AI · fact-checked ·
Expanded incident disclosure
Fireworks AI’s October security incident affected customer account and billing information, and a limited set of accounts also had secrets, datasets and incomplete models affected. The company’s update, last updated November 9, adds to a bulletin published October 9.
The earlier bulletin had identified access to Fireworks-stored secrets, including those used in evaluation jobs. The company notified law enforcement and brought in Palo Alto Networks Unit 42 to help conduct forensic analysis.
The company says evidence indicates links to a financially motivated cybercriminal group aimed at selling tokens obtained through unauthorized access to large language models to illicit routing gateways, a practice known as LLMJacking. Google Threat Intelligence Group and Mandiant published a blog post about LLMJacking on November 2, covering its rise, motives, techniques and mitigation.
How the activity reached Fireworks
A third-party cloud provider that hosted Fireworks research and development machines had a security incident on October 23. On October 24, the unauthorized third party used it to reach Fireworks development machines and run an unauthorized workload that led to additional customer data impact.
The company detected the activity that day, took immediate remediation measures and closed known critical vulnerabilities. As of October 25, the company had not detected further evidence of successful unauthorized access on the platform used by customers.
Information affected
The affected internal application exposed several categories of information, including resource metadata such as Fireworks resource identifiers, display names, descriptions and creation times. Billing information included billing and shipping addresses, invoice and payment history, account balances and credit usage.
Fireworks says it does not store payment card numbers and that they were not affected. For some customers, a subset of incomplete model weights and datasets was accessed. The company is notifying customers whose data was affected and providing details about the impact and recommended response actions.
Fireworks says it has not detected an impact to Inference, Training SDK or Nexus, which it describes as zero data retention by default. The company cautions that these findings reflect its investigation to date, which is ongoing and may reveal additional information.
Response and service status
Working with Unit 42, the company identified and implemented security hardening procedures across access, networks, data protection and forensic logging. The company revoked and replaced credentials and service accounts, removed unnecessary elevated privileges, and tightened controls that, the company says, were intended to prevent new unauthorized credentials.
Unauthorized network pathways were restricted and affected systems isolated, the company says, to prevent further activity and movement between systems. The company also reviewed access to data storage and analytics systems and applied controls intended to prevent public or unauthorized access to stored data. The company secured and enhanced its logging and monitoring systems.
During the investigation, the company disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training. Training SDK remains available with zero data retention, meaning training data is not stored at rest, while Fireworks Lab-based training runs in an isolated environment with additional network and storage protection.
The company says it continues to work with Unit 42 on the investigation and security hardening, and will monitor its systems 24/7.