Fireworks AI breach: attackers reached dev machines via a cloud provider; Notion says under 1% of workspaces hit

Fireworks AI, the inference platform that hosts open-weight models for developers, said on 9 November 2026 that attackers who broke into a third-party cloud provider on 23 October used that foothold to reach its development machines the next day. The company's update says the intruders saw resource metadata, billing details, incomplete model weights and datasets for some customers, and secrets in a limited set of accounts. It follows an earlier, separate incident in early October in which API keys and tokens were taken. Notion, a Fireworks customer, says less than 1% of its workspaces may be affected.

Key points

• Fireworks says a third-party cloud provider hosting its R&D machines had an incident on 23 October 2026, and on 24 October an unauthorized party used it to reach Fireworks development machines and run an unauthorized workload.
• Data involved, per Fireworks: resource metadata, billing information (addresses, invoice and payment history, balance, credit usage), a subset of incomplete model weights and datasets for certain customers, and secrets in a limited set of accounts. Payment card numbers are not stored and were not affected.
• Fireworks says inference, the Training SDK and Nexus are zero data retention (ZDR) by default and that it has detected no impact on them. It has disabled self-serve dataset uploads and downloads for Batch Inference and dataset-based training during the investigation.
• Notion says it found that fewer than 1% of its workspaces may have had unattributable Notion AI chat transcripts exposed, and has stopped sending traffic to Fireworks.
• Fireworks has notified law enforcement and engaged Palo Alto Networks' Unit 42 for forensic analysis.

What to do

Who is affected: Fireworks customers who received an incident notice from Fireworks, and Notion workspace owners who were contacted by Notion. Fireworks' original bulletin says that if you did not receive an affected-customer notice, it has not identified your account as affected so far and no incident-specific action is required. Notion says the same: if neither you nor your workspace owner has heard from it, no action is needed right now.

If you are a Fireworks customer with a notice:

1. Replace revoked Fireworks API keys with new ones and update your applications. Apps using revoked keys will fail authentication until updated.
2. Rotate or revoke every third-party credential listed in your notice with the company that issued it (a cloud provider, a model vendor, a database). Fireworks stresses that deleting a stored secret does not invalidate the credential itself.
3. Review access logs for those credentials for unauthorized reads, downloads or changes, and rotate them even if you find nothing suspicious.
4. Check API keys, users, evaluators, training jobs and datasets for anything you do not recognize, and send the names or IDs to Fireworks.
5. Contact Fireworks by replying to your notice or writing to security-notice@fireworks.ai (the October bulletin gave security@fireworks.ai). Fireworks says it can share secret names and credential fingerprints through a secure channel.

If you are a Notion workspace owner who was notified: open the sidebar, choose the question-mark menu, then "Security incident review", in the desktop app or a web browser on the latest version (the data is not available on mobile). Enterprise owners can download a CSV of the affected data and an annotated version with the user attached to each chat; owners on other plans get a link they can share so members can see their own affected data. Notion recommends treating the data as exposed and rotating any password or API key that anyone pasted into Notion AI.

What happened

Fireworks first disclosed trouble in early October. According to its original bulletin, the company identified suspicious activity at 9am PDT on 6 October and began containment. It started notifying affected customers on 7 October, rotated employee API keys on 9 October, and published the bulletin that evening. The bulletin said an unauthorized third party had accessed environment variables used in evaluation jobs in a limited number of customer accounts, and that API keys and tokens stored as secrets were likely captured in certain accounts. On 10 October it revoked more user API keys and rotated service-account tokens after a credential review.

The 9 November update describes a second path. A third-party cloud provider that hosted Fireworks R&D machines "experienced a security incident" on 23 October, in the words BleepingComputer quotes from the advisory. On 24 October the unauthorized party used that access to reach Fireworks development machines and run an unauthorized workload, which led to additional customer data impact. Fireworks says it detected the activity the same day, took remediation steps, and that as of 25 October it had seen no further evidence of successful unauthorized access to the platform customers use. The update does not name the cloud provider.

The data list is wider than in the first bulletin. It covers resource metadata such as identifiers, display names, descriptions and creation times; billing information; and, for certain customers, a subset of incomplete model weights and datasets. For a limited set of accounts, secrets were also involved.

Fireworks says the evidence links the activity to a financially motivated group that sells unauthorized access to large language models to illicit routing gateways, a practice known as "LLMjacking". That attribution was first stated in its early October notice, as BleepingComputer reports.

Since then it has revoked and replaced credentials and service accounts, removed unneeded elevated privileges, tightened the controls for creating credentials, restricted unauthorized network paths, isolated affected systems, tightened access to storage and analytics systems, and improved logging and monitoring, working with Unit 42.

Background

Fireworks runs hosted inference for open-weight models such as Mistral's, Meta's Llama and Google's Gemma, which is why a breach there matters beyond its own staff: customers hand it API keys for other services, datasets for fine-tuning, and billing details. Notion describes it as an AI infrastructure platform used by tens of thousands of customers and hundreds of thousands of developers.

LLMjacking, the stated motive, means using stolen keys to run models on someone else's bill. BleepingComputer reports that a week before this update, researchers at Google's Threat Intelligence Group and Mandiant said LLMjacking is driving record costs for compromised organizations, with cloud AI charges reaching as high as $1 million; we have not independently opened that report. For how leaked keys outlive the breach that exposed them, see our piece on Truffle Security's secrets revocation program, and for another recent abuse of trusted cloud access see the Qubole cross-account case.

How the customer impact played out at Notion

Notion's help-center notice gives the clearest account of a downstream customer's timeline. It says it learned from Fireworks about potential incidents earlier this month and shut down all connections out of caution. By 3 November it had disconnected its systems from Fireworks, deleted all data held there, stopped sending traffic and halted training runs. On 6 November Fireworks told Notion that malicious actors may have accessed potential customer data; on 8 November Fireworks confirmed a new dataset, and Notion found it included Notion AI chat transcripts used for its Insights feature.

Notion calls the chats "unattributable": they were not labeled with who wrote them or which workspace they came from, and the transcripts held no tool-call results (page content or external data Notion AI had pulled in). Beyond the words in the transcript, it says nothing ties a chat to a workspace, user or company. That is a meaningful limit, but a transcript can still contain whatever a person typed, which is why Notion advises rotating any credentials pasted into Notion AI. Notion had used Fireworks for classification jobs behind Insights and as an inference provider for open-weight models; it has disabled Insights during the investigation and no longer serves open-weight models through Fireworks. It also says that in its Learning and Early Access Program, volunteered data was used in the past to experiment with training task-specific models on Fireworks.

What it means

For developers, the lesson is blast radius. Environment variables in evaluation jobs and training configurations are easy to treat as private, but a platform compromise turns them into live credentials. Short-lived, narrowly scoped keys limit what a thief can do and how long it works; a stolen long-lived key to a cloud account is worth far more than a stolen model-provider key.

For teams that route data through AI vendors, the Notion case shows how far one supplier's breach can travel: a customer-facing feature (usage insights) quietly depended on a third party, and a breach two steps away from the customer reached it. Questions worth asking vendors: which subprocessors see prompts, whether data is retained, and how fast they will tell you.

For Fireworks, ZDR by default is a partial shield: it says inference traffic was not affected, but datasets and weights uploaded for training and batch jobs sat outside that protection, which is why it paused self-serve dataset transfers.

What we don't know yet

• The name of the third-party cloud provider, and whether other customers of that provider were hit.
• How many Fireworks accounts or customers are affected overall. Fireworks says "limited" but gives no count.
• Whose model weights and datasets were taken, how incomplete they were, and what they contain.
• Whether the two incidents (early October and 23 to 24 October) are connected beyond the attribution to the same type of actor. Fireworks' update presents the second as a new path, and BleepingComputer calls it a new breach.
• When the paused Batch Inference and dataset-based training uploads will return.

What to watch next

Watch Fireworks' bulletin page for further updates and the results of the Unit 42 investigation, other Fireworks customers publishing their own notices after Notion, and whether the cloud provider identifies itself. If you are a customer, check your inbox, including spam, for an incident notice.

Sources

• Fireworks AI: October 2026 security incident, update of 9 November (primary source)
• Fireworks AI: original October 2026 security incident bulletin
• Notion Help Center: notice about the Fireworks AI incident
• BleepingComputer: Fireworks AI discloses new breach after cloud provider hack