Fireworks AI breach: attackers reached billing data, datasets and incomplete model weights

AI inference provider Fireworks AI widened its disclosure of an October incident on 9 November: attackers reached billing data and, for a limited set of accounts, datasets and incomplete model weights.

Fireworks AI, a leading platform for running AI models through an API, published a wider account of an October security incident on 9 November 2026, according to The Defiant and other outlets. The first notice described access to environment variables in evaluation jobs for a limited number of accounts. The update is broader: attackers reached billing data and, for some accounts, secrets, datasets and incomplete model weights.

The way in ran through an incident at an external cloud host. An unauthorized party used it to reach Fireworks development machines and ran its own workload there. The billing records include resource metadata, billing addresses, invoices and account balances. Fireworks says it does not store payment card numbers, so cards are not affected. It also reports no detected impact on Inference, the Training SDK or Nexus, which run with zero data retention by default.

The scope is still disputed. As late as 10 October the company said it had found no evidence of unauthorized access to customer models, datasets or training data. A source cited by Bloomberg reportedly puts the breach at tens of thousands of files, some containing customer data. Fireworks has not said how many customers are affected. Reports differ slightly on the detection date, so we leave it out.

What the company did: replaced credentials and service accounts, removed unneeded elevated privileges, isolated affected systems and tightened access to data storage and logging. It has also disabled self-service dataset transfers for batch inference and dataset-based training for now. Fireworks tells customers to rotate third-party credentials with the issuing providers, because deleting a stored secret does not by itself invalidate the key.

This is part of a pattern. Wiz counted at least nine AI developer platforms that disclosed an incident in October. If you run applications on one of them, treat every environment variable the platform could read as potentially exposed and rotate it.