Fireworks AI breach reached some customers' model weights

If you fine-tuned on Fireworks AI, check your inbox.

Fireworks AI says an attacker reached its development machines in October and, for some customers, accessed incomplete model weights, datasets and secrets.

What Fireworks says was taken

In an update to its security bulletin, last revised November 9, Fireworks says a third-party cloud provider hosting its research machines had a security incident on October 23.

On October 24, an unauthorized party used that access to reach Fireworks development machines and ran a workload that hit more customer data. Fireworks says it detected that the same day.

Its first bulletin, on October 9, said only secrets, such as those used in evaluation jobs, were known to have been accessed. The update widens that. Fireworks now lists:

• resource metadata: identifiers, display names, descriptions and creation times
• billing information: addresses, invoice and payment history, account balance and credit usage
• for a limited set of accounts, secrets, datasets and a subset of incomplete model weights

Fireworks says it does not store payment card numbers. It says its Inference, Training SDK and Nexus products, which run with zero data retention by default, show no detected impact.

The company ties the activity to a financially motivated group that sells tokens obtained through unauthorized access to language models, a practice it calls "LLMJacking". Fireworks says it notified law enforcement and brought in Palo Alto Networks Unit 42 for forensics.

Your vendor's vendor is your attack surface

For a small AI company, a fine-tuned model and the data behind it can be most of what it owns.

According to the bulletin, the attacker came in through a cloud provider Fireworks used for research, not through the platform customers use. That is the uncomfortable part. You picked Fireworks. You didn't pick its cloud provider.

Zero data retention held, per Fireworks. What leaked was stored: datasets customers uploaded and weights from training jobs. If you keep assets on a platform, retention promises about live traffic don't cover them.

What to do this week

Fireworks says it is notifying affected customers and will send them recommended response actions directly. The bulletin does not tell every customer to rotate keys.

Do it anyway if you used Fireworks for training or evaluation:

• rotate any API keys or secrets you passed into Fireworks jobs
• ask Fireworks in writing whether your account's weights or datasets were in the accessed subset, at the contact the bulletin gives, security-notice@fireworks.ai
• check your provider dashboards for model usage you don't recognize, since the group Fireworks names sells stolen access

Fireworks has also disabled self-serve dataset uploads and downloads for Batch Inference and dataset-based training. If your pipeline depends on them, plan around the gap.

Watch the customer count

The bulletin gives no number of affected customers. It says the investigation is ongoing and may turn up more.

Watch for the next update. Then decide where your weights live.