Fireworks AI breach: hackers stole customer data and model weights

What happened

Fireworks AI is a US company that runs and customizes AI models for other businesses. On November 9, 2026, it admitted that a hack discovered in October was much bigger than it had first said. For about a month, attackers had access to customer account and billing data, and for some customers also to datasets and incomplete model weights. Forbes reporter Anna Tong broke the story. Fireworks has published an updated security bulletin.

This is no small vendor. According to Forbes, Fireworks has around 10,000 business customers, including Uber, Shopify, Upwork, DoorDash and the coding tool Cursor. Nvidia is among its backers, and in July the company was valued at $17.5 billion. Its core business is inference: running a fully trained model to generate responses. Customers don't have to operate their own GPU servers. Companies can also use Fireworks to fine-tune models on their own data, meaning they further train an existing model with company-specific examples.

What data was affected

In early October, Fireworks said only environment variables from evaluation jobs had been exposed. Those are configuration values used when testing models. According to the updated bulletin, analyzed by ShiftDelete.Net, one affected internal application gave access to far more:

Fireworks says it has found no impact on the inference service, the Training SDK or Nexus. By default, these services don't store customer data ("Zero Data Retention"). The company stresses, however, that the investigation is still ongoing.

How the attackers got in

The attack came in two waves:

• October 6: Fireworks notices that internal credentials are being misused. It starts notifying customers on October 7, and by October 9 employee API keys have been rotated. A security bulletin goes out on October 9, followed by an update on October 10. At that point, the incident appeared to be contained.
• October 23/24: An external cloud provider where Fireworks runs machines for research and development is hacked. Through that access, the attackers reach Fireworks' development machines on October 24 and run unauthorized compute jobs there. According to news agency ChainCatcher, cited by KuCoin, this second attack targeted the storage for research data. Fireworks says it detected the activity the same day. Since October 25, there has reportedly been no successful access to the customer platform.

Fireworks attributes the attack to a financially motivated group engaged in LLMjacking. Criminals steal access to large language models and resell the compute through illicit middlemen, while the actual account holder foots the bill. CEO Lin Qiao wrote on X in October that the attackers' behavior suggested AI agents were involved, meaning AI programs that carry out steps on their own.

What Fireworks is doing

The company says it has brought in law enforcement and is working with Unit 42, the incident response and threat research unit of security firm Palo Alto Networks. Credentials have been rotated, affected systems isolated and access rights restricted. Self-service dataset uploads and downloads for batch inference (processing many requests at once) and for dataset-based training are temporarily suspended. According to Cryptobriefing, affected customers have been notified directly.

Trust has taken a hit anyway. Forbes spoke to two customers who have already moved most of their business away from Fireworks. One of them described a series of "very bad hacks" that are becoming more frequent.

What customers should do now

ShiftDelete.Net recommends these steps for Fireworks customers:

• Rotate your API keys and all secrets stored on the platform, even if you haven't been notified.
• Check your billing and credit usage for unexpected charges, the telltale sign of LLMjacking.
• Review which datasets were uploaded for batch jobs and whether they contained personal or confidential data.
• If you have questions, reply to the incident email or contact security-notice@fireworks.ai.

Cryptobriefing also warns of targeted phishing: anyone who knows real invoices, addresses and account balances can craft very convincing fake invoices or payment requests. If you only use Fireworks for live inference, the company says you're not affected.

Analysis

The case highlights a risk that grows as companies lean more heavily on AI providers. If you upload your own data for fine-tuning, you're also exposed to your provider's security gaps, and to those of its suppliers. At Fireworks, a single break-in at an external cloud provider was enough for attackers to get back in weeks after the first, quickly contained attack. Leaked datasets and partially trained models are especially sensitive, since they involve intellectual property and potentially personal data. Exactly which customers were affected, and to what extent, remains unclear.

Fireworks isn't an isolated case. According to Cryptobriefing, there were at least nine security incidents at AI platforms in October alone. ShiftDelete.Net points to a breach at provider Northflank, where stolen AI API keys were abused. Fireworks' communication also deserves criticism: an incident first described as minor turned out a month later to be far more serious. For companies choosing AI providers, security audits matter more than ever, as does the question of which data you hand over in the first place.