Fireworks AI says a compromise at a third-party cloud provider allowed attackers to reach its development machines, exposing customer billing details and some AI model data. BleepingComputer’s November 10 report describes the company’s second security disclosure following an earlier incident reported to customers and law enforcement in early October.
Developers use Fireworks’ inference platform—the infrastructure that runs AI models to generate responses—to operate open-source models including Mistral, Meta’s Llama and Google’s Gemma. The newly disclosed breach involved customer account information, alongside incomplete model weights and datasets belonging to some customers.
The billing information accessed included billing and shipping addresses, invoice and payment histories, account balances and credit usage. Fireworks said payment card numbers were protected from this exposure because it does not store them.
Attackers also accessed metadata, the descriptive information attached to resources: Fireworks identifiers, display names, descriptions and creation times. The model material included incomplete weights—the numerical parameters that shape a model’s behavior—as well as datasets.
From cloud provider to development systems
BleepingComputer places Fireworks’ discovery of another security incident on October 23, after the company revoked credentials connected to the earlier breach. Separately, a Monday advisory quoted in the report gives Fireworks’ account of the provider compromise and subsequent activity.
In that account, the cloud provider hosting Fireworks’ research and development machines experienced a security incident on October 23. On October 24, an unauthorized party used that compromise to reach Fireworks’ development machines and run a computing workload that caused additional customer data impact.
Fireworks said it detected that activity on October 24, took immediate response measures and closed known critical vulnerabilities. Its statement that it had found no further evidence of successful attacker access to the customer-facing platform was dated as of October 25.
The earlier incident involved access to environment variables—settings available to running software—that held secret API keys and tokens for a limited number of accounts; Fireworks notified customers and law enforcement in early October, linked the activity to a financially motivated group seeking to sell tokens for unauthorized large language model access through illicit routing gateways, and revoked compromised internal credentials, affected Fireworks API keys and keys the attackers had created.
That abuse is known as LLMjacking: stolen credentials let unauthorized users make AI requests at the victim’s expense. BleepingComputer also cited findings published a week earlier by Google’s Threat Intelligence Group and Mandiant, which reported fraudulent requests using stolen API keys generating cloud AI charges as high as $1 million at compromised organizations.
Credentials replaced and systems isolated
Fireworks’ response to the new attack included revoking and replacing credentials and service accounts, restricting unauthorized network routes and isolating affected systems. The company also tightened controls around storage and analytics systems to prevent public or unauthorized access to stored data.
Palo Alto Networks’ Unit 42 incident response division is now helping Fireworks investigate the breach’s full scope and impact and strengthen its systems against further attacks.
