By Thorsten Meyer | November 10, 2026 | ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Key takeaways
- What happened: Fireworks AI, a platform that runs and fine-tunes open AI models for companies, says a security incident it first disclosed in October reached further than it thought. In an update dated November 9, 2026, it says attackers got to account and billing information and, “for a limited set of accounts”, to “secrets, datasets, and incomplete models”.
- Two ways in: In October, someone used “internal Fireworks credentials” to read environment variables from customers’ evaluation jobs. Later, attackers came in through “a third-party cloud provider that hosted Fireworks R&D machines” and ran “an unauthorized workload” on October 24.
- What Fireworks says was not hit: payment card numbers, which it says it does not store, and its Inference, Training SDK and Nexus products, for which it has “not detected any impact”.
- A customer speaks up: Notion says chat transcripts from its Notion AI Insights feature were in a dataset the attackers may have accessed. It puts the share of affected workspaces at “fewer than 1%”.
- What is not known: which cloud provider was breached, how many customers are affected, how the internal credentials were first obtained, and what happened to the stolen data.
Products Worth Considering
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz
DJI Osmo Mobile 8 3-Axis Phone Gimbal Stabilizer
Sony WH-1000XM6 Wireless Noise-Canceling Headphones, Black
As an affiliate, we earn on qualifying purchases.
A breach that grew in the telling
On October 9, Fireworks AI published a security bulletin that sounded contained. Someone had misused internal credentials and read environment variables, the settings where developers often keep API keys and tokens, in “a limited number of customer accounts”. At the time, Fireworks wrote that it had “not detected evidence of unauthorized access to customer models, datasets, training data, inference traffic (including prompts and outputs), or personal information”.
A month later, that picture has changed. “Since then, we discovered impacts to account and billing information,” Fireworks writes in its update. “For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models.”
The Defiant summed up the update in its headline: “Fireworks Says Breach Exposed Billing Data, Datasets and Incomplete Model Weights”. The Hacker News, BleepingComputer and The Record report the same scope.
Fireworks is not a household name, but it sits underneath many AI products. Companies send it data to fine-tune models and run them. That is exactly why this incident matters beyond one company.
What happened, step by step
Here is the order of events as Fireworks and Notion describe them. Fireworks gives its October times in Pacific time (PDT).
- October 6, 9am: Fireworks “identified the activity and began containment”.
- October 7, 7am: It “Started notifying affected customers”.
- October 9: It rotated employee API keys and, at 10pm, published its first bulletin.
- October 10: It revoked more user API keys and rotated service-account tokens.
- October 23: “A third-party cloud provider that hosted Fireworks R&D machines experienced a security incident.”
- October 24: “the unauthorized third party used it to reach Fireworks development machines and then run an unauthorized workload that led to additional customer data impact.” Fireworks says it detected this the same day.
- October 25: Since then, Fireworks says, it has “not detected further evidence of successful unauthorized access by the threat actor on the Fireworks platform customers use.”
- November 2 to November 8: Notion says Fireworks told it on the evening of November 2 about a small dataset that turned out to be synthetic test data, then on November 6 that “malicious actors may have accessed potential customer data”, and confirmed that dataset on November 8.
- November 9: Fireworks publishes its update.
Fireworks says it notified law enforcement and brought in Palo Alto Networks Unit 42 for the forensic work.
Drawn to scale, the gap is plain: 34 days passed between the first detection on October 6 and the update of November 9.
What was exposed, and what Fireworks says was not
Fireworks lists three kinds of information that “the affected internal application provided access to”:
- Resource metadata: “Fireworks resource identifiers, display names, descriptions, creation time, etc.”
- Billing information: “billing and shipping addresses, invoice and payment history, account balance, and credit usage.”
- Model weights and datasets: “for certain customers, a subset of incomplete model weights and datasets were accessed.”
Model weights are the learned numbers that make a model what it is. For a company that fine-tuned a model on its own data, the weights are part of its product. Fireworks says the weights were “incomplete”. It does not explain what that means, for example whether they were unfinished training runs or partial copies.
On the other side of the ledger, Fireworks says: “Payment card numbers are not stored by Fireworks and were not impacted.” And: “We have not detected any impact to Inference, Training SDK and Nexus, which are all zero data retention (ZDR) by default.” Zero data retention means the service is not supposed to keep your prompts, outputs or training data after it has used them. Fireworks adds that “Our investigation is ongoing and may reveal additional information.”
As a precaution, Fireworks has “disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training while we investigate this incident.”
Who Fireworks says is behind it
Fireworks does not name a group. It writes that “The evidence indicates links to a cybercriminal threat actor group, which is financially motivated and aimed at selling tokens from unauthorized access to Large Language Models (LLMs) to illicit routing gateways”. It calls this “LLMJacking”.
In plain words: criminals steal access to AI models, then resell it cheaply, while the victim pays the bill. Fireworks points to a November 2 report by Google Threat Intelligence Group and Mandiant on this trend. Google writes that in individual cases it saw “fraudulent charges associated with resource consumption exceeding $100,000 USD in a single day, with cumulative charges at some organizations reaching $1 million USD before access was revoked.” Those figures come from Google’s own incidents, not from Fireworks. Here they are as a chart, with one more figure from the same report: one actor “executed more than 500,000 LLM API calls in less than eight hours”.
The customer side: Notion’s notice
Notion is so far the clearest public example of what this means for a customer. It used Fireworks “for classification jobs” in a feature called Insights and “as a general inference provider to serve open-weight models inside our product.”
According to Notion, the data that may have been accessed “included Notion AI chat transcripts used for the Insights feature, which for the vast majority of impacted workspaces were unattributable.” Notion explains that “Unattributable” means “the chats weren’t labeled with who wrote them or which workspace they came from.”
Notion says it had disconnected its systems from Fireworks and “deleted all data in the Fireworks system” by the morning of November 3. Insights is switched off for now, and Notion is “no longer serving open-weight models through Fireworks.” Its advice to affected customers: “treat this data as if it were exposed”, and if anyone pasted “sensitive information, passwords, API keys, or other credentials into Notion AI during the timeframe of the incident, rotate them.”
What this means for businesses
AI providers are a new kind of supplier. You do not just send them requests. You often hand them datasets, evaluation jobs with stored secrets, and the fine-tuned models that come out of it. If they are breached, all of that can be in play. Three lessons from this case:
1. Secrets stored at a provider are only as safe as the provider. The first part of this incident was about environment variables in evaluation jobs. Fireworks’ own advice to affected customers is blunt: “Removing a stored secret alone does not invalidate the underlying credential.” If a key to your cloud, database or another AI service sat in a provider’s job settings, the fix is to rotate it at the service that issued it. Deleting it from the provider’s dashboard is not enough.
2. Know what your provider keeps at rest. Fireworks says its products that run with zero data retention by default showed no impact. What was hit were stored things: datasets, model weights, billing records. Ask every AI provider which of your data it stores, for how long, and how you can delete it.
3. Your supplier has suppliers. The second way in was not Fireworks’ own platform but a third-party cloud provider that hosted its research machines. Your contract with an AI provider should tell you who its key subprocessors are and how fast it must tell you about an incident. Notion says Fireworks confirmed the dataset with its customer data on November 8, more than a month after Fireworks first detected the incident on October 6.
What Fireworks customers should check now, based on Fireworks’ own guidance:
- Replace Fireworks API keys that were revoked, and update the apps that used them.
- Rotate any third-party keys or tokens named in your notice with the provider that issued them, even if you see nothing suspicious.
- Review the logs of those providers for “unauthorized reads, downloads, or changes”.
- Look for unknown “API keys, users, evaluators, training jobs, and datasets” in your Fireworks account and report them.
- If you have no notice, Fireworks says “no incident-specific action is currently required”. Contact it if you see anything odd.
Beyond Fireworks, set spending caps and alerts on every AI API account. Google recommends “spending caps to set budgets and avoid over-spending.” In LLMjacking cases, a surprise bill is often the first sign.
What this means for users
Most people have never heard of Fireworks, and that is the point. When you use an AI feature inside an app, your words may pass through several companies you never chose. Notion’s case shows that chat transcripts can end up at an AI provider for features like usage analysis.
The practical rule is old but holds: do not paste passwords, API keys or other credentials into AI chats. If you did, and you use an app that names Fireworks as a provider, change them. If an app tells you your workspace was affected, follow its instructions. Notion says affected customers can review the impacted data inside their workspace.
What we don’t know
- Which cloud provider was breached. Fireworks calls it only “a third-party cloud provider”.
- How the first credentials were obtained. Fireworks says “internal Fireworks credentials” were misused, but not how the attacker got them.
- How many customers are affected. Fireworks says “a limited set of accounts” and “a limited number of customer accounts”. It gives no number. Notion is the only customer I found that has published its own notice.
- Which models and datasets. Fireworks does not say whose weights were taken or what “incomplete” covers.
- Whether both incidents are the work of one group. Fireworks describes the October 24 activity as further activity by “the threat actor”, and it does not name the group.
- What happened to the data. Nothing published says whether it was sold, leaked or used.
- Whether the list is final. Fireworks says its investigation “is ongoing”.
The bottom line
The Fireworks case is a reminder that the AI stack has a supply chain like everything else, and attackers are working their way along it. For companies, the work is unglamorous: know which AI providers hold your data, keep secrets out of their job settings where you can, rotate keys at the source, and put a ceiling on your AI bills. For users, keep secrets out of chat boxes.
For more context, read how a stolen AI token becomes cash on the black market, how the Chainalysis breach grew update by update, and why AI has taken the clock off cyberattacks.
I’m Thorsten Meyer. The full sources are below, and more reality checks are at thorstenmeyerai.com.
Sources
- Fireworks AI: “Update on October 2026 security incident”, security bulletin, last updated November 9, 2026, fireworks.ai/security/bulletins
- Fireworks AI: “Fireworks October 2026 security incident”, security bulletin, last updated October 10, 2026, fireworks.ai/security/bulletins
- Notion: “Fireworks AI incident”, security advisory, updated November 9, 2026, notion.com/security/advisories
- Google Threat Intelligence Group and Mandiant: “The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources”, Google Cloud Blog
- The Defiant: “Fireworks Says Breach Exposed Billing Data, Datasets and Incomplete Model Weights”, November 9, 2026
- The Hacker News: “Fireworks AI Breach Widens to Expose Customer Billing Data and Incomplete Model Weights”, November 10, 2026
- BleepingComputer: “Fireworks AI discloses new breach after cloud provider hack”, November 10, 2026
- The Record by Recorded Future News: “AI company Fireworks says hackers stole data, billing info during October breaches”, November 10, 2026
Researched and drafted with AI assistance, including Anthropic’s Claude. No company named here reviewed or sponsored this article. This article is for information only. It is not legal or security-consulting advice. Statements as published by Fireworks AI and Notion as of November 10, 2026; check their pages for later updates. Images: AI-generated illustration (Runware) and graphics by Thorsten Meyer AI; no real people or logos are shown.
