🔍 Read the full analysis: What To Audit After The Fireworks AI Breach Widens on ThorstenMeyerAI.com
Get audio and creator gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Fireworks AI’s November 9 update says an October security incident reached account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. Notion says chat transcripts from its AI Insights feature may have been in an accessed dataset, affecting fewer than 1% of workspaces. Fireworks has not named the third-party cloud provider or disclosed the total number of affected customers.
Fireworks AI said in a November 9 security update that an October incident affected more customer information than the company had initially reported, including account and billing data and, for a limited set of accounts, secrets, datasets and incomplete model weights. Notion separately said chat transcripts from its Notion AI Insights feature may have been in a dataset attackers could access, affecting fewer than 1% of workspaces.
Fireworks, which provides infrastructure for running and fine-tuning open AI models, described two routes of access. In the first, attackers used internal Fireworks credentials to read environment variables from customer evaluation jobs. Such variables can contain API keys or other tokens, but Fireworks has not said how the credentials were first obtained. In a later event, a third-party cloud provider hosting Fireworks research and development machines experienced a security incident. Fireworks says an unauthorized party used that access on October 24 to reach development machines and run an unauthorized workload that led to additional customer-data exposure.
The company’s revised list of accessed information includes resource metadata, such as identifiers and descriptions; billing and account details, including addresses, invoices, payment history, balances and credit usage; and, for certain customers, a subset of datasets and incomplete model weights. Fireworks has not explained what “incomplete” means or how much of any dataset or model was accessed. It says it does not store payment card numbers and that card numbers were not affected.
Fireworks’ timeline says it identified the first activity on October 6 and began containment that day, then started notifying affected customers on October 7. It published its first bulletin October 9 and described the incident then as limited. The company says it detected the later unauthorized workload on October 24 and has not detected further successful access on the customer platform since October 25. It says it notified law enforcement and hired Palo Alto Networks Unit 42 to conduct forensic work.
What to audit after the Fireworks AI breach widens
Fireworks AI’s November 9 update expanded the reported scope of an October incident. Customers should check accounts, credentials and data while the investigation remains open.
What the update added
The revised account includes customer information beyond the scope described in Fireworks’ October bulletin.
Billing and resource details
Accessed information included account and billing details, resource identifiers and descriptions.
Secrets and development data
For certain accounts, the reported scope also included secrets, datasets and incomplete model weights.
AI Insights transcripts
Notion said transcripts may have been in an accessed dataset; it reported fewer than 1% of workspaces affected.
Audit accounts and data
Use company notices and internal records to identify what could be involved.
- Confirm which accounts, projects and datasets were involved.
- Review API keys, tokens and other secrets in evaluation-job environments; rotate credentials where appropriate.
- Map datasets and model-development jobs to internal owners and check for sensitive information.
- Review billing records, addresses and invoices for internal exposure or unusual activity.
What remains uncertain
The investigation has not publicly established the full extent or use of accessed information.
- Total affected customer count
- The third-party cloud provider’s name
- How internal credentials were obtained
- What “incomplete” model weights means
- Which datasets and how much were accessed
- Whether data was downloaded, retained or used
- Whether sensitive or regulated information was included
- When temporary dataset restrictions will end
What AI Customers Should Audit
The expanded scope matters because Fireworks operates behind products and services built by other companies. Exposure at an AI infrastructure provider can affect customers that rely on it to handle training data, datasets and model development, not just the provider’s own accounts. A dataset or secret accessed in an incident could create follow-on risks if it contains confidential material or credentials that remain usable.
Customers using Fireworks should check which accounts, projects and datasets were involved, then review API keys, tokens and other secrets that may have been present in evaluation-job environments. They should identify whether billing records, addresses or invoice details require internal review, and whether a dataset used for training or evaluation contained customer or employee information. These are precautionary audit steps, not evidence that every customer’s data was accessed.
Fireworks says it has not detected impact to its Inference, Training SDK and Nexus products, which it describes as zero data retention by default. That statement is limited to the company’s current findings; its investigation is ongoing. Customers should distinguish that product-specific assurance from the separately reported exposure of data associated with certain accounts and services.
Products Worth Considering
DJI Osmo Mobile 8 3-Axis Phone Gimbal Stabilizer
Sony WH-1000XM6 Wireless Noise-Canceling Headphones, Black
Jackery Explorer 1000 v2 Portable Power Station, 1070Wh, 1500W
As an affiliate, we earn on qualifying purchases.
From October Bulletin to Expanded Scope
Fireworks’ October 9 bulletin said the company had not detected unauthorized access to customer models, datasets, training data, inference traffic—including prompts and outputs—or personal information. The November 9 update added impacts to account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. The change shows that the initial account did not capture the full scope later identified by the investigation.
Notion said Fireworks first contacted it on November 2 about a dataset it initially understood to be synthetic test data. On November 6, Fireworks told Notion that attackers may have accessed potential customer data; on November 8, it confirmed the dataset involved. Notion said chat transcripts from its AI Insights feature were present and put the share of affected workspaces at fewer than 1%. That is Notion’s stated figure, not a disclosed total count of affected users or transcripts.
Fireworks says it disabled self-service dataset uploads and downloads used by Batch Inference and dataset-based training while it investigates. The company’s update does not name the cloud provider involved in the later event.
“For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models.”
— Fireworks AI, November 9 security update
Scope and Data Use Still Unknown
Fireworks has not disclosed the number of affected customers, named the third-party cloud provider, or explained how the internal credentials used in the earlier access were obtained. It has also not said whether attackers downloaded, retained, published or otherwise used the accessed information. The company’s description of a “limited set” of accounts does not provide a count or a customer-by-customer breakdown.
The extent of access to datasets and model weights is also unsettled. Fireworks has not detailed what it means by incomplete model weights, which datasets were involved, or whether the affected material included sensitive or regulated information. Notion has identified its AI Insights transcripts as present in a dataset attackers may have accessed, but the source material does not establish that the transcripts were taken or misused.
Fireworks says it has not detected further successful access on its customer platform after October 25, but its investigation remains open. That is a statement about what the company has detected so far, not a public accounting of all data potentially viewed or copied.
Customer Notices and Forensic Findings
Fireworks says it is continuing its investigation with Unit 42 and has notified law enforcement. It has not announced a date for a final report or said when the temporary restrictions on self-service dataset uploads and downloads will end. Customers may receive more specific notices as the company determines which accounts and data were affected.
Organizations using Fireworks should review notices from the company and their own logs, identify potentially exposed secrets and rotate credentials where appropriate. They can also map affected datasets and model-development jobs to internal owners, check whether sensitive information was included, and assess billing records for unusual activity. Those checks can help establish exposure within an organization; they do not settle what the attackers did with any information.
The next significant disclosures would be a clearer customer count, details about the cloud-provider incident, and findings on the extent and handling of accessed data. Until Fireworks or affected customers provide those details, the full scope and consequences remain unresolved.
Key Questions
What information does Fireworks say was affected?
Fireworks says attackers accessed account and billing information and, for a limited set of accounts, secrets, datasets and incomplete model weights. It also lists resource metadata among the information available through the affected application.
Were payment card numbers exposed?
Fireworks says it does not store payment card numbers and that they were not affected. It did report access to other billing information, including addresses, invoices, payment history, account balances and credit usage.
What did Notion report?
Notion said chat transcripts from its AI Insights feature were in a dataset attackers may have accessed. It said fewer than 1% of workspaces were affected; the public information does not establish that the transcripts were misused.
What should Fireworks customers audit?
Customers can review account and project notices, check whether evaluation jobs contained API keys or other secrets, rotate credentials as a precaution, and identify datasets or model work that may include sensitive information. They should also examine billing records for anomalies.
What remains unknown about the incident?
Fireworks has not named the cloud provider, disclosed the number of affected customers, explained how the internal credentials were obtained, or said what happened to data attackers may have accessed. Its investigation is ongoing.
Source: ThorstenMeyerAI.com
