If you run models on Fireworks AI, treat every credential you ever stored there as burnt. The company has told customers that its October break-in was bigger than first described: some accounts also lost billing details, datasets and unfinished models.
Fireworks serves open and custom AI models to developers over an API, which is why stolen keys matter. Anyone holding one can run models at the owner’s expense, and that is exactly the business of the group Fireworks blames: criminals who resell access to language models through illicit gateways, a practice known as LLMjacking. Fireworks says Google’s threat-intelligence team and Mandiant wrote about the trend on 2 November.
In its updated bulletin, Fireworks lists what the intruders could see through an internal application. Through that application the intruders could read account metadata (IDs, names, descriptions, when things were created), customers’ invoices and payment history with their addresses and balances, and, for some accounts, stored secrets plus datasets and models still in training. Fireworks does not keep card numbers, so none were exposed. The bulletin gives no count of affected accounts.
The timeline has two parts. Fireworks noticed misuse of its internal credentials on 6 October, and its first bulletin three days later said only evaluation-job secrets, which can include API keys and tokens, were taken. Weeks later the picture changed. A company that hosted Fireworks’ R&D servers was itself hit on 23 October, and on 24 October someone used that foothold to get onto Fireworks’ development machines and start a job of their own, which exposed the extra data. Fireworks says it saw this the same day. It reports no new successful access to the customer-facing platform after 25 October, and it has not said which provider was involved.
Three products sit outside the damage, according to Fireworks: Inference, the Training SDK and Nexus, all of which retain no customer data by default. It adds that the investigation is not finished and that this could change.
The clean-up is under way with Palo Alto Networks’ Unit 42, and law enforcement has been told. Fireworks has replaced keys and service accounts, cut unnecessary admin rights, walled off affected systems and locked down data stores. Until further notice you cannot upload or download datasets yourself for Batch Inference or dataset-based training. Training through the SDK continues, and Fireworks Lab runs are isolated.
What to do: replace any Fireworks key that was revoked, and rotate third-party credentials kept on the platform with their own issuers, because removing a secret from Fireworks does not cancel it. Afterwards, audit your account for activity you did not start, whether that is a stray user, a new key, a training run or a dataset. Customers with affected data are being emailed, and questions go to [email protected].
