Fireworks AI Discloses Second Breach in November Update: Attackers Ran Unauthorized Workloads on Development Machines

AI inference provider Fireworks AI disclosed a second security incident in a November 9 update, revealing that attackers compromised a third-party cloud provider on October 23 and used that access the next day to reach Fireworks development machines and run unauthorized workloads. The activity exposed customer billing data, resource metadata, and incomplete model weights and datasets for some accounts.

The update, published November 9, substantially widens the scope of what the company first reported on October 9. That initial bulletin described unauthorized use of internal credentials detected on October 6, affecting environment variables in evaluation jobs — including API keys and tokens — for a "limited number of customer accounts." At the time, Fireworks said it had found no evidence of access to models, datasets, training data, inference traffic, or personal information.

Second incident originated from compromised third-party cloud provider

According to Fireworks' update, a third-party cloud provider hosting the company's research and development machines experienced its own security incident on October 23. On October 24, the unauthorized party used that provider's environment to reach Fireworks development machines and execute an unauthorized workload that led to "additional customer data impact." Fireworks detected the activity the same day and initiated containment.

The company said it has not detected further evidence of successful unauthorized access to the customer-facing platform since October 25.

Data categories affected

Fireworks grouped the affected data into three categories:

• Resource metadata: Fireworks resource identifiers, display names, descriptions, creation timestamps
• Billing information: Billing and shipping addresses, invoice and payment history, account balances, credit usage. Payment card numbers are not stored by Fireworks and were not impacted
• Model weights and datasets: For certain customers, a subset of incomplete model weights and datasets were accessed

The company said it is notifying affected customers directly with details and recommended response actions.

Notion confirms customer AI chat transcripts exposed

Digital workspace company Notion published its own notice confirming that some of its customers' data was caught in the Fireworks breach. Notion said it used Fireworks for classification jobs supporting its "Insights" feature — which helps workspace administrators understand AI usage — and as a general inference provider for open-weight models.

Notion was notified of the incident on November 2 and disconnected its systems from Fireworks on November 3, deleting all data in the Fireworks system. The Record reported that Notion said Fireworks notified it on November 6 that malicious actors may have accessed potential customer data [2]. Notion's own notice states Fireworks confirmed the new dataset on November 8 [8]. Notion's investigation determined that Notion AI chat transcripts used for the Insights feature were included in the exposed data.

For the "vast majority of impacted workspaces," the chat transcripts contained only the input or output from the model written to the chat, without additional metadata linking them to specific workspaces, users, or companies. However, Notion acknowledged that the conversation content itself may contain sensitive data. Notion said fewer than 1% of its workspaces may have been affected and has disabled the Insights feature while investigating.

Render CEO Anurag Goel shared a Notion notification email stating that "some unattributable chat sessions with Notion AI may have been exposed in this incident." Bloomberg reported Fireworks is also working with customers including Cursor and Harvey to assess impact.

Attack linked to "LLMJacking" campaigns

Fireworks said evidence indicates links to a financially motivated cybercriminal threat actor group engaged in "LLMJacking" — stealing tokens from unauthorized access to large language models and reselling them through illicit routing gateways. The company referenced a November 2 blog post by Google Threat Intelligence Group and Mandiant detailing the rise of LLMJacking, its motives, techniques, and mitigation.

Mandiant said it has responded to multiple LLMJacking incidents in 2026 across cloud and LLM providers, impacting organizations in North America, South America, and Asia Pacific across financial services, retail, technology, and transportation sectors. Researchers observed fraudulent charges exceeding $100,000 in a single day at individual organizations, with cumulative charges reaching $1 million before access was revoked.

Google Threat Intelligence Group identified a "diverse set of financially motivated threat clusters operating out of multiple regions globally" and noted operational specialization: some groups focus on initial access before handing off to others that monetize and resell unauthorized LLM access.

Zero data retention claims require scrutiny

Fireworks stated it has not detected any impact to Inference, Training SDK, and Nexus, "which are all zero data retention (ZDR) by default." However, CEO Lin Qiao clarified on X that this applies to "Inference (excluding batch inference), Training SDK, and Nexus." Fireworks' policy page notes that the Zero Data Retention policy is available on Enterprise accounts and is off by default, and that features including stored responses, batch jobs, and training do store customer content.

VentureBeat reported that the breach reached the stored side of Fireworks' infrastructure. The company has disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training during the investigation. Training SDK remains available with ZDR, and Fireworks Lab-based training operates in an isolated environment with additional network and storage protection.

Remediation and investigation ongoing

Working with Palo Alto Networks Unit 42, Fireworks said it has implemented security hardening including access and credential lockdown (revoking and replacing credentials, removing unnecessary elevated privileges), network isolation of affected systems, tightened data storage access controls, and enhanced logging and monitoring.

The company said its investigation is ongoing and may reveal additional information. It did not disclose how many customers were affected by either incident.