Fireworks AI says its October breach also hit customer datasets, incomplete models and billing data
An updated bulletin links the intrusion to a financially motivated 'LLMJacking' group selling stolen model access; Fireworks says inference, the Training SDK and Nexus show no impact.
Why it matters
Fireworks first disclosed in October that internal credentials were misused to reach secrets used in evaluation jobs. The update widens that: a third-party cloud provider hosting its R&D machines was breached on 23 October, and the attacker used it the next day to reach development machines. Fireworks says it found no further successful access after 25 October and is working with Palo Alto Networks Unit 42. Watch how many customers were affected and whether any move off the platform.
Key facts
- First bulletin in October; update 9 Nov 2026
- Third-party cloud provider breached 23 Oct
- Development machines reached 24 Oct
- No further successful access found after 25 Oct
- Linked to financially motivated 'LLMJacking' group
- Inference, Training SDK and Nexus not affected