Research

Fireworks AI Disclosed a Second Breach in a Month, Through a Cloud Provider It Does Not Name. If You Use It, Rotate Anything Stored There and Read Your Notification Email

Patrick Duggan · · 3 min read

Fireworks AI Disclosed a Second Breach in a Month, Through a Cloud Provider It Does Not Name. If You Use It, Rotate Anything Stored There and Read Your Notification Email
Facts for the Fireworks AI second breach disclosed November 9, 2026. A cloud provider hosting its research machines was hit October 23 and the attacker reached development machines October 24. Exposed: metadata, billing information and, for a limited set of accounts, secrets, datasets and incomplete models. Rotate every key stored there, read your notification email and check usage since October.

If your team uses Fireworks AI, rotate every API key, token and credential you ever stored in it, including secrets used in evaluation jobs, and check your inbox and spam for a security notice from the company. Fireworks updated its security bulletin on November 9, 2026 to disclose a second incident. A third-party cloud provider that hosted its research machines was hit on October 23, and the attacker used that access to reach Fireworks development machines on October 24. Fireworks says it detected the activity the same day and has found no further successful access since October 25.

What has been reported

The primary source is Fireworks' own bulletin, "October 2026 security incident update," last updated November 9. BleepingComputer reported it on November 10 and adds nothing the bulletin lacks. Neither names the cloud provider, and neither says how many customers were affected.

  • First incident, October 9 bulletin: at that point only secrets stored in Fireworks for evaluation jobs were known to be accessed. The company said the evidence linked the activity to a financially motivated group whose aim is selling tokens obtained through unauthorized access to large language models to illicit routing gateways. That is what the bulletin calls LLMjacking.
  • Second incident: the provider's incident on October 23, then the attacker's use of that access on October 24 to reach Fireworks development machines and run an unauthorized workload, which caused additional customer data impact.
  • What was exposed: resource metadata (identifiers, display names, descriptions, creation times); billing information (billing and shipping addresses, invoice and payment history, account balance and credit usage); and, for a limited set of accounts, secrets, datasets and incomplete model weights. The bulletin says "Payment card numbers are not stored by Fireworks and were not impacted."
  • Not affected, per Fireworks: its Inference, Training SDK and Nexus services, which it says are zero data retention by default.
  • Response: credentials and service accounts replaced, unauthorized network paths restricted, affected systems isolated, access to storage and analytics tightened, logging improved. Self-serve dataset upload and download for Batch Inference and dataset-based training is disabled while the investigation continues. It is working with Palo Alto Networks' Unit 42. The status is "Active monitoring."

The bulletin says affected customers are being notified with the impact and recommended actions. Those are not published on the page, so we cannot tell you whether your account is among them.

What to do

  1. Rotate every key and token that has ever been stored in Fireworks, and every credential that appeared in an evaluation job or a dataset you uploaded. Assume anything a job could read was readable.
  2. Check your notification email, including spam, for a message from Fireworks security. If you think your account was affected and have no message, write to the security contact the bulletin gives.
  3. Read your usage and billing history for spend or activity you did not cause, especially from October onward. The first incident was about selling stolen inference access, so unexplained usage is the signal.
  4. If you uploaded proprietary datasets or custom models, treat them as possibly exposed, and decide whether the contents are things you would need to disclose or re-secure.
  5. Billing addresses and payment history may have been exposed for any affected account, so expect more convincing billing-themed phishing aimed at your finance contacts.
  6. For anyone who builds on a hosted AI platform: keep the secrets you hand to a platform to the minimum, scope them narrowly, and make them quickly revocable. Ask each vendor which cloud provider hosts their engineering machines, because this incident was reached through that supplier.

What is not known

Which cloud provider. How many customers and which accounts. Whether the October 23 and October 9 incidents are the same attacker; the bulletin says it found the second while cleaning up the first but does not say they are one actor. What the unauthorized workload ran. We have no indicators to offer because none are published.

How we know, and how we checked

We read Fireworks' bulletin and BleepingComputer's report. They are one source. We did not test anything or contact the company. A corpus search found no earlier post of ours about this. We ingest nothing into our feed: there are no published indicators.

Sources

Fireworks AI, "October 2026 security incident update," updated November 9, 2026, and its original October 9, 2026 bulletin. BleepingComputer, "Fireworks AI discloses new breach after cloud provider hack," November 10, 2026.

Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.

Get your free key → analytics.dugganusa.com/stix/register