On November 9, AI inference platform Fireworks AI updated its bulletin on the October security incident, admitting the intrusion reached much further than first disclosed: attackers not only obtained internal credentials but also accessed some customers' billing information, datasets and unfinished model weights. The update overturns a key claim the company made more than a month ago, turning what looked like a credential leak into a loss of AI assets. Fireworks provides model inference and fine-tuning services to enterprises; Meta's former strategy chief recently joined the company to bet on the AI inference race.
According to the timeline in the bulletin, Fireworks discovered unauthorized use of internal credentials on October 6 and published its first bulletin on October 9, saying it had found no evidence that customer models, datasets, training data or inference traffic had been touched. The picture changed in late October: a third-party cloud provider hosting Fireworks' R&D machines suffered a security incident on October 23, and the next day attackers used that opening to reach Fireworks development machines and run an unauthorized workload. The company says it detected the activity the same day and took remedial action, and that as of October 25 it had found no further successful access on the platform customers use.
The accessed data falls into three categories: resource metadata, including resource identifiers, display names, descriptions and creation times; billing information, including billing and shipping addresses, invoice and payment history, account balances and credit usage; and, for some customers, secrets, datasets and a subset of incomplete model weights. Fireworks stresses that it does not store payment card numbers, which were not affected. The company attributes the attack to a financially motivated group that profits by reselling stolen access to large language models through illicit routing gateways, a practice known as LLMjacking, which Google's Threat Intelligence Group and Mandiant wrote about on November 2.
On the boundaries of the impact, the bulletin draws two lines: no impact has been detected on Inference, the Training SDK or Nexus, which are zero data retention by default; but that conclusion rests only on the investigation so far, which continues and may disclose more. As a response, self-serve dataset uploads and downloads used by Batch Inference and dataset-based training have been disabled for the duration of the investigation. The company says it serves more than 10,000 customers and is notifying affected customers one by one with recommended responses; Palo Alto Networks' Unit 42 is assisting the investigation and law enforcement has been notified. Customers who receive a notice should replace revoked keys and rotate related credentials as instructed; customers who receive no notice need take no incident-specific action for now, according to the earlier bulletin, but it is still worth checking whether they ever stored keys or datasets on the platform.
