🔍 Read the full analysis: Fireworks AI Breach Widens: What AI Teams Need To Examine on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Fireworks AI’s November 9 update says an October security incident affected account and billing information and gave attackers access to secrets, datasets and incomplete models for a limited set of accounts. Notion says chat transcripts from its AI Insights feature may have been in an accessed dataset, affecting fewer than 1% of its workspaces. The provider, customer count and fate of the accessed data remain unknown.
Fireworks AI said on November 9 that an October security incident reached further into customer information than the company initially reported, including account and billing details and, for a limited set of accounts, secrets, datasets and incomplete models. Notion separately said transcripts from its Notion AI Insights feature may have been in a dataset attackers could access, affecting fewer than 1% of its workspaces.
Fireworks, which hosts and fine-tunes open AI models for businesses, described two access routes. In the first, identified on October 6, someone used what the company called internal Fireworks credentials to read environment variables from customer evaluation jobs. Such variables can contain configuration information and credentials, though Fireworks has not specified which values were exposed or how the internal credentials were obtained.
Fireworks later reported a separate incident involving a third-party cloud provider that hosted its research and development machines. The provider experienced a security incident on October 23, the company said; on October 24, an unauthorized party used that access to reach Fireworks development machines and run an unauthorized workload that led to additional customer data impact. Fireworks said it detected that activity the same day.
The company said information available through the affected internal application included resource metadata, billing and shipping addresses, invoice and payment history, account balances and credit usage. For certain customers, a subset of incomplete model weights and datasets was accessed. Fireworks says it does not store payment-card numbers and that those numbers were not affected. It also says it has detected no impact to Inference, Training SDK or Nexus, which it describes as zero-data-retention by default.
Fireworks said it began containing the first activity on October 6, started notifying affected customers on October 7 and published an initial bulletin on October 9. It said it rotated employee API keys and later revoked additional user API keys and rotated service-account tokens. The company says it has detected no further successful access by the threat actor on the customer platform since October 25. It has disabled self-service dataset uploads and downloads used by Batch Inference and dataset-based training while its investigation continues.
Fireworks AI Breach Widens What AI Teams Need to Examine
Fireworks AI’s November 9 update expanded the reported scope of an October security incident. The exposure may include customer account and billing information, credentials, datasets and incomplete models.
Two reported access routes
Fireworks described activity involving internal credentials and a third-party cloud provider.
On October 6, internal credentials were used to read environment variables from customer jobs.
After a provider incident on October 23, an unauthorized workload reached Fireworks development machines on October 24.
Information potentially in scope
The reported categories do not mean every type of data was accessed for every affected account.
Business records
Information included resource metadata, billing and shipping addresses, invoices, payment history, balances and credit usage.
Secrets and credentials
Environment variables can contain credentials; Fireworks has not specified which values were exposed.
Datasets and models
A limited set of accounts had access impact involving datasets and incomplete model weights.
What the disclosures say
The companies describe different limits and findings; some details remain unconfirmed.
| Area | Reported detail | Still unclear |
|---|---|---|
| Notion AI Insights | Transcripts may have been in an accessed dataset | Which workspaces or records were involved |
| Payment cards | Fireworks says it does not store card numbers | Other account and billing data affected by account |
| Data fate | Investigation is ongoing | Whether accessed information was copied, retained or used |
Review your AI provider exposure
Teams can use the disclosures to focus an account level review.
- Identify information sent to AI infrastructure providers.
- Check which credentials, datasets and model assets could have been reachable.
- Review vendor and cloud supplier incident response procedures.
- Watch for direct notices from Fireworks and your service providers.
Risks for AI Customer Data
The disclosure matters because companies sending data to an AI infrastructure provider may have exposure beyond prompts and model outputs. Billing records, credentials, datasets and model weights can reveal business relationships, provide access to other systems, or contain sensitive material used to train or evaluate models. The specific risk depends on what each customer stored and which accounts were affected; the available information does not establish that every category was accessed for every customer.
Notion’s account gives the incident a concrete customer example. The company said Fireworks notified it on the evening of November 2 about a dataset initially described as synthetic test data, then on November 6 that malicious actors may have accessed potential customer data. Fireworks confirmed the dataset on November 8, according to Notion. Notion says the relevant transcripts may have been included and that fewer than 1% of workspaces were affected. That figure is Notion’s stated share of workspaces, not a count of affected users or a measure of how much transcript content was accessed.
For AI teams, the development is a reason to establish what information was sent to providers, which credentials or datasets could have been reachable, and whether internal response procedures account for vendors and their cloud suppliers. Those are prudent review areas, not evidence that any particular customer has suffered misuse.
Products Worth Considering
Amazon Kindle Paperwhite (2024, 16 GB) – 7-inch Glare-Free Display, Black
Bose QuietComfort Earbuds (2nd Gen) – True Wireless Bluetooth Earbuds with Active Noise Cancellation
DJI Osmo Mobile 8 3-Axis Phone Gimbal Stabilizer
As an affiliate, we earn on qualifying purchases.
From Initial Notice to Expanded Scope
Fireworks’ October 9 bulletin described misuse of internal credentials and access to environment variables in a limited number of customer accounts. At that stage, the company said it had not detected evidence of unauthorized access to customer models, datasets, training data, inference traffic, prompts, outputs or personal information. Its November 9 update added account and billing information and access to secrets, datasets and incomplete models for a limited set of accounts.
The second route emerged through a third-party cloud provider hosting Fireworks R&D machines. Fireworks’ account places the provider incident on October 23 and the unauthorized workload on October 24. The company says it engaged Palo Alto Networks Unit 42 for forensic work and notified law enforcement. Its update also says the investigation may reveal additional information. The disclosures therefore describe a changing understanding of scope, rather than a final accounting of affected data.
“For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models.”
— Fireworks AI, November 9 security update
Scope and Data Fate Remain Unknown
Fireworks has not named the third-party cloud provider, said how many customers were affected, or explained how attackers first obtained the internal credentials used in the earlier activity. It has also not said what happened to information accessed during either route, whether it was copied or retained, or whether it has been used.
The company describes some model weights as incomplete but has not defined that term or explained what portion of any model was accessible. Its statements that it detected no impact to specified products and no further successful access since October 25 describe the findings reported so far, not a claim that every possible effect has been ruled out. Fireworks says its investigation is ongoing and could produce additional findings.
Notion’s advisory identifies a possible dataset containing AI Insights chat transcripts, but the available account does not specify the number of affected workspaces, the transcripts involved, or whether attackers actually viewed individual records. The stated percentage is fewer than 1% of workspaces; a total workspace count and the affected users’ circumstances were not provided in the source material.
Further Findings and Customer Notices
Fireworks says it is continuing its investigation with forensic support from Unit 42 and has notified law enforcement. Its next stated steps include maintaining precautions around dataset uploads and downloads while it investigates and informing customers as it determines what information was affected. The company has not given a date for a final report or said when those dataset functions will be restored.
Customers should watch for direct notices from Fireworks and their own service providers, since the reported impact is limited to certain accounts and the company has not published a complete customer list. Further updates will need to clarify the affected cloud provider, the number and types of impacted accounts, what data was accessed or taken, and whether investigators found evidence of later misuse.
Key Questions
What did Fireworks AI say was affected?
Fireworks reported access to account and billing information and, for a limited set of accounts, secrets, datasets and incomplete model weights. It also listed resource metadata. The company says payment-card numbers were not stored or affected.
Were Notion AI chats involved?
Notion said chat transcripts from its AI Insights feature may have been in a dataset attackers could access. Notion said fewer than 1% of its workspaces were affected. The source material does not establish that attackers viewed each transcript or disclose a total number of affected workspaces.
How did the incident happen?
Fireworks described two routes: misuse of internal credentials to read environment variables from customer evaluation jobs, and access through a security incident at a third-party cloud provider hosting Fireworks R&D machines. The company has not identified the provider or explained how the internal credentials were first obtained.
What information has Fireworks said was not affected?
Fireworks says it does not store payment-card numbers and that they were not impacted. It also says it has detected no impact to Inference, Training SDK and Nexus, which it describes as zero-data-retention by default. Its investigation remains ongoing.
What should Fireworks customers expect next?
Fireworks says it is continuing its investigation, working with Unit 42 and law enforcement, and has temporarily disabled some dataset uploads and downloads. Customers should look for direct communications; the company has not announced a final report date or a restoration schedule for those functions.
Source: ThorstenMeyerAI.com
