🔍 Read the full analysis: Fireworks AI Breach Raises Questions About Data And Model Weights on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Fireworks AI’s November 9 update says attackers accessed account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. Notion says transcripts from its AI Insights feature may have been in an accessed dataset, affecting fewer than 1% of its workspaces. The provider, number of affected customers and fate of accessed data remain unknown.
Fireworks AI said on November 9 that attackers accessed account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models, broadening its account of a security incident first disclosed in October. Notion separately said transcripts from its Notion AI Insights feature may have been included in a dataset attackers could access, affecting fewer than 1% of workspaces, according to the company.
Fireworks, a platform companies use to run and fine-tune open AI models, described two stages of activity. In October, someone used what the company called internal Fireworks credentials to read environment variables from customer evaluation jobs. Developers commonly use those variables to store settings and access tokens. Fireworks said it identified activity on October 6 and began containment, then started notifying affected customers on October 7.
The company later reported a separate route into its systems. A third-party cloud provider hosting Fireworks research-and-development machines experienced a security incident on October 23. Fireworks says an unauthorized party used that access the following day to reach development machines and run an unauthorized workload, causing additional customer data impact. It said it detected that activity on October 24 and has found no further evidence of successful access on the platform customers use since October 25.
Fireworks lists exposed information as resource metadata, billing details and, for certain customers, a subset of incomplete model weights and datasets. Billing information may include billing and shipping addresses, invoice and payment history, account balance and credit usage. The company says it does not store payment card numbers and that card numbers were not affected. It also says it has detected no impact to Inference, Training SDK or Nexus, which it describes as zero-data-retention by default. Fireworks disabled self-service dataset uploads and downloads used by Batch Inference and dataset-based training while it investigates.
Fireworks AI breach exposes unanswered questions
Fireworks AI says attackers accessed account and billing information, and limited data from some accounts. The scope and fate of accessed information remain unknown.
What Fireworks says was exposed
The reported categories do not mean every item was accessed for every customer.
Account and billing details
May include addresses, invoices, payment history, balances and credit usage.
Secrets, datasets and models
Fireworks reported impact to secrets, datasets and incomplete model weights for a limited set of accounts.
Payment card numbers
Fireworks says it does not store card numbers and they were not impacted.
Two stages of activity
In October, someone used what Fireworks called internal credentials to read environment variables from customer evaluation jobs.
After a cloud provider incident on October 23, an unauthorized party reached Fireworks development machines the following day and ran an unauthorized workload.
What customers should understand
The disclosures describe possible exposure, not confirmed misuse.
- Notion says AI Insights transcripts may have been in an accessed dataset.
- Fireworks says it found no further successful access on the customer platform after October 25.
- Whether data was removed, retained, shared or used.
- How many Fireworks customers were affected and which cloud provider was involved.
Risks for Customer Data and Models
The incident matters because Fireworks provides infrastructure used by businesses to handle model development and AI workloads. The disclosed categories go beyond account administration: datasets and model weights can contain or embody customer-specific work, while secrets may provide access to systems or services. The source material does not establish that every exposed category was obtained for every affected customer, or that any accessed data was used after the incident.
Notion’s disclosure illustrates how a breach at an infrastructure provider can affect a customer’s own users. Notion says chat transcripts from its AI Insights feature were in a dataset that attackers may have accessed, and puts the share of potentially affected workspaces at fewer than 1%. That is a company-reported scope, not a confirmed count of individuals or proof that each transcript was read or taken.
For customers, the expanded account may prompt checks of credentials, datasets and billing records associated with the platform. The impact on any particular organization depends on what information its account contained and whether that information was actually accessed or misused. No such misuse is established in the supplied disclosures.
Popular right now
De'Longhi Rivelia Automatic Espresso Machine with Grinder and Milk Frother, Beige
Sony WH-1000XM5 Premium Noise Cancelling Wireless Headphones – Midnight Blue
Vitamix Touch & Go Advance 32-Ounce Bar Blender, White
As an affiliate, we earn on qualifying purchases.
From October Alert to Broader Disclosure
In its October 9 bulletin, Fireworks said it had not detected evidence of unauthorized access to customer models, datasets, training data, inference traffic—including prompts and outputs—or personal information. Its November 9 update revised that picture, saying it had since discovered impact to account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. The company’s investigation, in other words, produced a broader disclosure over time.
Fireworks says it rotated employee API keys on October 9, revoked more user API keys and rotated service-account tokens on October 10, and brought in Palo Alto Networks Unit 42 for forensic work. It also says it notified law enforcement. Notion’s advisory describes a separate notification timeline: Fireworks contacted it on November 2 about a dataset first thought to contain synthetic test data, then said on November 6 that malicious actors may have accessed potential customer data. Notion says the dataset was confirmed on November 8.
Fireworks has not named the cloud provider or a suspected group. The source material says the company described evidence as indicating links to a cybercriminal group, but the account is cut off before identifying or explaining those alleged links. No attribution can be established from the available information.
“For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models.”
— Fireworks AI, November 9 security update
Scope and Data Fate Remain Unknown
The available disclosures do not say how many Fireworks customers were affected, which cloud provider was involved, or how the internal credentials used in the first stage were obtained. Fireworks also has not explained what “incomplete” means for the affected model weights, such as whether they were partial copies or unfinished training outputs.
It remains unclear whether attackers removed, retained, shared or used the accessed information, and whether any data was exploited. Notion’s statement concerns possible access to a dataset; it does not confirm that attackers read individual transcripts. Fireworks says its investigation is ongoing, so the reported categories and scope could be revised.
Investigation and Customer Updates
Fireworks says it is continuing its investigation with support from Unit 42 and has disabled certain dataset upload and download functions while that work proceeds. The company says it has not detected further successful unauthorized access on the customer platform after October 25. It has not provided a date for restoring the disabled functions or for publishing another update.
Customers and readers will need further reporting from Fireworks to clarify the number of affected accounts, the cloud provider involved, the meaning and extent of the model-weight exposure, and what happened to accessed data. Notion’s advisory provides a separate account of its potentially affected workspaces, but the supplied information does not give a confirmed number of transcripts or people involved.
Key Questions
What information does Fireworks AI say attackers accessed?
Fireworks says attackers accessed account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. It also lists resource metadata. The company says payment card numbers were not affected because it does not store them.
Were Notion AI chat transcripts involved?
Notion says transcripts from its AI Insights feature were in a dataset attackers may have accessed. It says fewer than 1% of workspaces were affected. That disclosure does not confirm that attackers read or took individual transcripts.
Were all Fireworks products affected?
Fireworks says it has detected no impact to Inference, Training SDK or Nexus, which it describes as zero-data-retention by default. It has not said that all other accounts or products were affected; the disclosed exposure applied to a limited set of accounts for some data categories.
How many customers were affected, and what happened to the data?
The available disclosures do not give a total number of affected Fireworks customers or say whether accessed data was retained, shared or misused. Fireworks says its investigation is ongoing.
Source: ThorstenMeyerAI.com
