Fireworks AI credential misuse and customer data access

Summary

Fireworks AI, an AI inference and training provider, disclosed that an unauthorized party misused internal credentials from October 6, 2026 and captured secrets stored in a limited number of customer accounts. A November 9 update said a second intrusion through a third-party cloud provider later reached billing data, datasets and incomplete model weights. Notion said the incident exposed Notion AI chat transcripts from under 1 percent of its workspaces. The investigation is ongoing.

What happened

• Fireworks said it found unauthorized use of internal credentials on October 6 and that environment variables used in customer evaluation jobs, including stored API keys and tokens, were captured.
• According to Fireworks, a third-party cloud provider hosting its R&D machines had a security incident on October 23, and the intruder used that access to reach Fireworks development machines on October 24.
• The November update lists affected account and billing information, including addresses, invoice and payment history, and credit usage. Fireworks said it does not store payment card numbers.
• For a smaller set of accounts, Fireworks said secrets, datasets and incomplete model weights were accessed.
• Notion said Fireworks first described the affected data as synthetic test data, then told Notion on November 6 that customer data may have been accessed.

Timeline

• 2026-10-06 - Fireworks identifies the credential misuse and begins containment.
• 2026-10-09 - Fireworks publishes its first bulletin after notifying affected customers.
• 2026-10-24 - The intruder reaches Fireworks development machines through the cloud provider.
• 2026-11-03 - Notion disconnects from Fireworks and deletes its data there.
• 2026-11-09 - Fireworks publishes its expanded update.

What the vendor has confirmed

Fireworks linked the activity to a financially motivated group that resells stolen access to large language models, a practice known as LLMjacking. It said it notified law enforcement, engaged Palo Alto Networks Unit 42, rotated credentials and paused self-serve dataset uploads and downloads. It reported no impact on its zero-retention inference service.

What remains unclear

• The number of affected Fireworks customers has not been disclosed.
• Fireworks has not explained how the cloud provider was compromised or named it.
• The threat actor group has not been named.

Broader context

Inference providers sit downstream of many AI products, so a compromise there reaches the end users of customers who never chose the provider directly.

Sources

• Fireworks AI bulletin: October 2026 security incident, October 9, 2026 (vendor-disclosure)
• Fireworks AI bulletin: Update on October 2026 security incident, November 9, 2026 (vendor-disclosure)
• Notion advisory: Fireworks AI incident, November 10, 2026 (vendor-disclosure)
• The Record coverage (press)