Fireworks Says Hackers Reached Customer Datasets and Unfinished Model Weights Through Its Cloud Provider

Fireworks, the AI inference platform valued at $17.5 billion in its most recent reported round, disclosed on November 9 that the security incident it first addressed in an October 9 bulletin reached further than stored credentials. For a limited set of customers, the company says, attackers accessed portions of datasets and unfinished model weights, along with billing records and resource metadata.

The new route began outside Fireworks. A third-party cloud provider hosting the company's research and development machines experienced a security incident on October 23. The next day, an unauthorized party used that opening to reach Fireworks' development machines and run a workload that exposed customer information. Fireworks says it detected the activity on October 24 and immediately took remediation measures, including closing known critical vulnerabilities.

The affected internal application exposed several categories of data: resource metadata including identifiers, display names, descriptions and creation times; billing records including billing and shipping addresses, invoices and payment histories, account balances and credit usage; and, for certain accounts, secrets, portions of datasets and incomplete model weights — the numerical values that make up a model. Payment card numbers were not affected because Fireworks does not store them.

Fireworks says it has detected no further successful unauthorized access to its customer platform since October 25, though the investigation is ongoing and the company cautions that more information could emerge. Its Inference, Training SDK and Nexus services were not affected, and the Training SDK remains available without training data stored at rest. The immediate customer impact is operational: self-serve dataset uploads and downloads stay disabled for some batch-inference and dataset-based training workflows while the investigation continues.

The company has notified law enforcement, engaged Palo Alto Networks' Unit 42 to investigate, replaced credentials and strengthened monitoring. Customers affected by the expanded scope are being notified directly.

Fireworks believes the attackers were a financially motivated cybercriminal group seeking to sell unauthorized access to large language models through illicit routing gateways — a practice the industry calls LLMJacking. The company frames that as an assessment of motive, not a public identification of a specific group.

The incident is a textbook supply-chain breach with a new twist: the crown jewels are no longer just customer records but partially trained model weights, proprietary assets that can represent months of compute budget. And the path in ran through the vendor's cloud vendor — a reminder that when an AI platform hosts your datasets and your training runs, its suppliers' security posture is effectively an extension of yours.