Fireworks AI, a San Mateo company that hosts AI models for more than 10,000 customers, said a second October intrusion reached customer billing records and, for some accounts, unfinished model files and datasets — a wider impact than it described when it first disclosed a breach last month.
The Nov. 9 update to Fireworks' security bulletin reaches beyond the companies that chose the vendor. Notion, which used Fireworks to classify customer AI chats and serve open-weight models, has told fewer than 1% of its workspaces that some Notion AI chat transcripts may have been exposed. Those users never chose Fireworks. Their data was sitting on a vendor's vendor.
Fireworks said an "affected internal application" provided access to resource metadata, including identifiers, display names and creation times; billing information, including addresses, invoices, payment history, account balances and credit usage; and, "for certain customers, a subset of incomplete model weights and datasets." The company said it does not store payment card numbers and that those numbers were not impacted. It has not said how many customers were affected, or which customers' model files were reached.
The company now describes two episodes in October. On Oct. 6, Fireworks identified "unauthorized use of internal Fireworks credentials." An unauthorized party accessed environment variables used in evaluation jobs in "a limited number of customer accounts," including API keys and tokens stored as secrets, the original bulletin said. At that time, Fireworks said it had not detected unauthorized access to customer models, datasets, training data, personal information or inference traffic. It started notifying affected customers on Oct. 7, said it had notified the identified accounts by Oct. 9, and published the first bulletin that night.
The later activity took a different path. "A third-party cloud provider that hosted Fireworks R&D machines experienced a security incident on October 23," the Nov. 9 update said. "On October 24, the unauthorized third party used it to reach Fireworks development machines and then run an unauthorized workload that led to additional customer data impact." Fireworks said it detected that activity the same day. As of Oct. 25, it said, it had not detected further successful unauthorized access "on the Fireworks platform customers use." It has not named the cloud provider, or formally attributed both events to a named group.
Fireworks said the evidence "indicates links" to a financially motivated cybercriminal group aimed at selling tokens from unauthorized access to large language models through illicit routing gateways, a tactic known as LLMJacking. That is the company's characterization of the evidence, not an independent confirmation of the motive. It said it notified law enforcement, hired Palo Alto Networks' Unit 42, revoked credentials, isolated affected systems and disabled self-serve dataset uploads and downloads while it investigates. It said it has not detected impact to Inference, its Training SDK or Nexus, which it says are zero-data-retention by default, a finding limited to the investigation so far. As of Nov. 9, it said it "is notifying customers whose data was impacted."
Notion's advisory shows how the exposure can travel. On the evening of Nov. 2, Fireworks told Notion that a small set of data had been accessed; Notion said that set was synthetic testing data, not customer data, and that by the next morning it had disconnected from Fireworks and deleted data in the Fireworks system. On Nov. 6, Fireworks told Notion that attackers "may have accessed potential customer data." On Nov. 8, it confirmed a new dataset, which Notion said included Notion AI chat transcripts used for an Insights feature, affecting fewer than 1% of workspaces. For the vast majority of those workspaces, Notion said, the chats were "unattributable" — not labeled with a user or workspace, and without tool-call results. It still advised affected customers to treat the data as exposed and to rotate credentials pasted into Notion AI during the incident window. It has disabled Insights and is no longer serving open-weight models through Fireworks.
A Fireworks spokesperson told Bloomberg on Nov. 9 that the company is "actively working with our customers to manage the incident, including Notion, Cursor and others." Bloomberg separately noted that Fireworks lists more than 10,000 customers on its website, including the legal technology firm Harvey, Notion and Cursor. Harvey was named as a listed customer, not as a company Fireworks said it was working with on the incident, and Fireworks has not publicly said whose model weights or datasets were accessed. Two customers told Forbes they had already substantially moved their business off Fireworks, with one describing a series of "very bad hacks."
In a Nov. 9 post on X, answering a claim that attackers had taken model weights, Fireworks co-founder and CEO Lin Qiao said: "From what we see attackers are not after weights. Most downloads were partial and stopped."
The episode underlines the difference between hosted inference and self-hosting. Fireworks' default zero-data-retention products, the company says, do not keep prompts and outputs. But customers also send the vendor secrets, training datasets and unfinished model files, and some products — Notion's Insights jobs among them — involve stored customer content. A leaked API key can be rotated. A leaked dataset, a partial model or a chat transcript cannot be taken back. Anyone building on a hosted model pipeline is also trusting that host's cloud suppliers.
As of Tuesday afternoon in New York, Fireworks, a private company, had not posted a public regulatory filing, and open-web checks of state attorney general breach notices did not turn up a Fireworks AI notice. The company said only that it had notified law enforcement.