Fireworks AI's breach got bigger, and zero retention was the only clean room
On October 9, Fireworks AI said the damage was stored secrets. On November 9 it updated the bulletin, and the list is longer: account and billing information, and, for a limited set of accounts, secrets, datasets and incomplete model weights.
Here's what the update says was reachable through the affected internal application. Resource metadata, meaning identifiers, display names, descriptions and creation times. Billing information, meaning billing and shipping addresses, invoice and payment history, account balance and credit usage. Fireworks says it doesn't store card numbers, so those weren't touched. And for certain customers, a subset of incomplete model weights and datasets. Fireworks is notifying affected customers directly with recommended response steps, and asks them to reply to the notification email or contact its security team.
The timeline in the bulletin: a third-party cloud provider hosting Fireworks R&D machines had its own incident on October 23, and the next day an unauthorized party used it to reach Fireworks development machines and run a workload that caused the additional customer data impact. Fireworks says it caught that the same day and has seen no further successful access to the customer platform since October 25. It links the actor to a financially motivated group that resells stolen LLM access, the pattern Google's threat intelligence team and Mandiant called LLMJacking in a Nov 2 post. Palo Alto Networks Unit 42 is doing the forensics, and law enforcement has been notified.
The cleanest line in the whole bulletin: Fireworks has detected no impact to Inference, the Training SDK or Nexus, all of which are zero data retention by default. Self-serve dataset uploads and downloads for Batch Inference and dataset-based training are switched off while the investigation continues. Fixes so far: rotated credentials and service accounts, removed excess privileges, isolated networks, locked down storage, improved logging.
For anyone building agents on a hosted inference provider, the takeaway is practical. Whatever you store with the vendor, whether eval secrets, fine-tune datasets or half-trained weights, is attack surface. Whatever you never store can't leak. If you used Fireworks' stored secrets or datasets, rotate those keys now, without waiting for the email, and check whether your products can run on the ZDR paths. Our coverage is a governance summary; the investigation is ongoing and the numbers may move.
Source: https://fireworks.ai/security/bulletins/october-2026-security-incident-update
← Back to all articles
Here's what the update says was reachable through the affected internal application. Resource metadata, meaning identifiers, display names, descriptions and creation times. Billing information, meaning billing and shipping addresses, invoice and payment history, account balance and credit usage. Fireworks says it doesn't store card numbers, so those weren't touched. And for certain customers, a subset of incomplete model weights and datasets. Fireworks is notifying affected customers directly with recommended response steps, and asks them to reply to the notification email or contact its security team.
The timeline in the bulletin: a third-party cloud provider hosting Fireworks R&D machines had its own incident on October 23, and the next day an unauthorized party used it to reach Fireworks development machines and run a workload that caused the additional customer data impact. Fireworks says it caught that the same day and has seen no further successful access to the customer platform since October 25. It links the actor to a financially motivated group that resells stolen LLM access, the pattern Google's threat intelligence team and Mandiant called LLMJacking in a Nov 2 post. Palo Alto Networks Unit 42 is doing the forensics, and law enforcement has been notified.
The cleanest line in the whole bulletin: Fireworks has detected no impact to Inference, the Training SDK or Nexus, all of which are zero data retention by default. Self-serve dataset uploads and downloads for Batch Inference and dataset-based training are switched off while the investigation continues. Fixes so far: rotated credentials and service accounts, removed excess privileges, isolated networks, locked down storage, improved logging.
For anyone building agents on a hosted inference provider, the takeaway is practical. Whatever you store with the vendor, whether eval secrets, fine-tune datasets or half-trained weights, is attack surface. Whatever you never store can't leak. If you used Fireworks' stored secrets or datasets, rotate those keys now, without waiting for the email, and check whether your products can run on the ZDR paths. Our coverage is a governance summary; the investigation is ongoing and the numbers may move.
Source: https://fireworks.ai/security/bulletins/october-2026-security-incident-update
Comments