🔍 Read the full analysis: What The Fireworks AI Breach Could Mean For Datasets And Model Weights on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Fireworks AI’s November 9 update says an incident first disclosed in October also affected account and billing information, and that secrets, datasets and incomplete model weights were accessed for a limited set of accounts. Notion says transcripts from its AI Insights feature were in a dataset attackers may have accessed, affecting fewer than 1% of workspaces. The number of affected Fireworks customers and what happened to accessed data remain unclear.
Fireworks AI said on November 9 that an October security incident reached further than first disclosed, including account and billing information and, for a limited set of accounts, secrets, datasets and incomplete model weights. The update matters to companies using the platform to run or fine-tune AI models because those materials can include sensitive business data and work in progress. Notion separately said transcripts from its AI Insights feature were in a dataset attackers may have accessed.
Fireworks’ October 9 bulletin said it had detected misuse of internal credentials and access to environment variables in a limited number of customer accounts. At the time, the company said it had found no evidence that customer models, datasets, training data, inference traffic or personal information had been accessed. Its November 9 update revised that account: Fireworks said it had since discovered impacts to account and billing information and, for a limited set of accounts, to secrets, datasets and incomplete models.
The company said the information available through an affected internal application included resource metadata, such as resource names and descriptions; billing and shipping addresses, invoice and payment history, account balance and credit usage; and, for certain customers, a subset of incomplete model weights and datasets. Fireworks has not explained what “incomplete” means or specified how much of any model or dataset was accessed.
Fireworks described two routes of activity. In October, someone used what the company called internal Fireworks credentials to read environment variables from customers’ evaluation jobs. Separately, Fireworks said a third-party cloud provider hosting its research and development machines experienced a security incident on October 23. The next day, an unauthorized party used that route to reach Fireworks development machines and run an unauthorized workload that led to additional customer data impact. Fireworks said it detected that activity the same day and has not detected further successful unauthorized access on its customer platform since October 25.
Fireworks said it does not store payment card numbers and that they were not affected. It also said it has detected no impact to its Inference, Training SDK and Nexus products, which it describes as zero data retention by default. The company disabled self-service dataset uploads and downloads used by Batch Inference and dataset-based training while investigating.
The Fireworks AI Breach What the exposure could mean
Fireworks AI’s November update expanded its account of an October incident to include customer information, datasets, secrets and incomplete model weights for a limited set of accounts. The affected customer count and what happened to accessed data remain unclear.
What may have been exposed
The disclosed materials could include sensitive business data and work in progress, but their contents and completeness have not been detailed.
Datasets and secrets
Datasets may contain private records or documents. Secrets could create risk if they include credentials or tokens that remain usable.
Incomplete weights
Weights can represent learned parameters and commercial work. Fireworks has not explained what “incomplete” means or how much was accessed.
Billing and metadata
The disclosure includes resource names and descriptions, billing and shipping addresses, invoice and payment history, balances and credit usage.
Two routes of activity
Fireworks described an initial incident and a separate development-environment incident.
In October, internal Fireworks credentials were used to read environment variables from a limited number of customers’ evaluation jobs.
After a cloud-provider incident on October 23, an unauthorized party reached Fireworks development machines the next day and ran an unauthorized workload.
Fireworks said it detected that activity on October 24 and reported additional customer data impact in its November 9 update.
What remains unclear
Public disclosures do not yet establish the scale or downstream use of the accessed data.
- How many Fireworks customers were affected
- Which datasets, secrets or model-weight files were accessed
- Whether data was copied, shared, sold, deleted or used
- Who carried out the activity or how credentials were obtained
- Notion said AI Insights transcripts were in a dataset attackers may have accessed
- The fewer-than-1% figure refers to Notion workspaces
- Fireworks says it detected no further successful platform access since October 25
- Payment card numbers were not stored by Fireworks and were not affected
Risks for Customer Data and Models
The disclosure reaches beyond ordinary account records because datasets and model weights can embody a company’s private material. A dataset may contain customer records, internal documents or other information used for training. Model weights are the learned parameters produced by training; for a company that has fine-tuned a model, they may represent part of its commercial work. The actual contents and completeness of the accessed materials have not been described, so the potential exposure cannot yet be measured from the public information.
Secrets can also create security risks if they include credentials or tokens that remain usable. Fireworks said it rotated employee API keys and later revoked additional user API keys and rotated service-account tokens. The company’s account of the incident does not establish that any exposed secret was used to access other systems.
For customers, the immediate practical issue is whether their account was among the affected set and whether any accessed data included sensitive or regulated information. Notion’s disclosure offers one concrete example: it said transcripts from Notion AI Insights were in a dataset that attackers may have accessed, and that fewer than 1% of workspaces were affected. That figure refers to Notion workspaces, not all Fireworks customers.
Popular right now
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
Vitamix 5200 Blender with 64 oz. Container, Black
Ninja Crispi Microwave & Air Fryer with FusionCrisp Technology, 14-in-1, Black (MW101BK1)
As an affiliate, we earn on qualifying purchases.
From October Alert to Expanded Disclosure
Fireworks said it identified the first activity on October 6 and began containment. It started notifying affected customers on October 7 and published its initial bulletin on October 9, after rotating employee API keys. On October 10 it revoked more user API keys and rotated service-account tokens. The company later described the separate cloud-provider incident on October 23 and the unauthorized workload on October 24.
Notion said Fireworks contacted it on November 2 about a small dataset initially understood to contain synthetic test data. On November 6, Fireworks told Notion that malicious actors may have accessed potential customer data; Notion said the dataset was confirmed on November 8. Fireworks published its broader update on November 9, about a month after its first public bulletin. It said it notified law enforcement and engaged Palo Alto Networks’ Unit 42 for forensic work.
Fireworks provides infrastructure for companies to run and fine-tune open AI models. That role can put customer datasets and development materials within a service provider’s systems, even when the customer’s own product is hosted elsewhere. The incident therefore raises questions for users of AI infrastructure about how provider-side credentials, development environments and stored training materials are protected.
“For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models.”
— Fireworks AI, November 9 security update
Scope and Data Use Still Unknown
Fireworks has not said how many customers were affected, which cloud provider experienced the security incident or how the internal credentials involved in the first activity were obtained. It has not identified the attackers. Its update says the investigation is ongoing and may reveal additional information.
The company has also not detailed which datasets or secrets were accessed, how many model-weight files were involved, or what “incomplete models” means in practice. There is no public account in the supplied disclosures of whether the accessed data was copied, shared, sold, deleted or used. Fireworks’ statement that it has detected no further successful access since October 25 does not answer those questions.
Notion’s account identifies a possible impact to transcripts from its AI Insights feature, but says attackers may have accessed the relevant dataset. The reported fewer-than-1% figure gives the proportion of Notion workspaces, not a count of users or transcripts. The available information does not establish whether other Fireworks customers had comparable data in exposed datasets.
Further Findings and Customer Notices
Fireworks says its investigation with Palo Alto Networks Unit 42 is ongoing and that it has notified law enforcement. The company says it will share further information if the investigation reveals additional findings. Customers should look for direct notices from Fireworks and review any guidance about credentials, datasets and account activity; the public update does not provide a complete customer-by-customer impact list.
Fireworks has temporarily disabled self-service dataset uploads and downloads used for Batch Inference and dataset-based training while it investigates. The company has not announced when those functions will return. The next substantive update is likely to clarify the affected customer count, the content and extent of accessed materials, and whether the investigation found evidence of data being taken or misused.
Key Questions
What did Fireworks AI say was accessed?
Fireworks said account and billing information were affected. For a limited set of accounts, it also reported access to secrets, datasets and incomplete model weights, as well as resource metadata.
Were payment card numbers exposed?
Fireworks said it does not store payment card numbers and that they were not affected. It did report impacts to other billing information, including addresses, invoice and payment history, account balances and credit usage.
Were Notion AI transcripts involved?
Notion said transcripts from its AI Insights feature were in a dataset attackers may have accessed. It reported that fewer than 1% of workspaces were affected; the public information does not specify the number of transcripts.
How many Fireworks customers were affected?
Fireworks has not disclosed a total number of affected customers. Its update describes the impact to secrets, datasets and incomplete models as involving a limited set of accounts.
What remains unknown about the incident?
The cloud provider involved, how the initial internal credentials were obtained, the full number of affected customers and what happened to accessed data have not been publicly established. Fireworks says its investigation is continuing.
Source: ThorstenMeyerAI.com
