Fireworks AI discloses new breach after cloud provider hack

The source has a clear timeline, so I’m drafting five sections in that order and checking paragraph length against the 40–90 word band.AI infrastructure startup Fireworks has disclosed a new security breach in which attackers accessed its development machines after breaching a third-party cloud provider, according to BleepingComputer's report by Sergiu Gatlan, published November 10, 2026, at 02:49 AM. Fireworks provides a high-performance inference platform for developers who want to deploy and run open-source artificial intelligence models without hardware bottlenecks and complex infrastructure tasks. The new disclosure follows an early October incident in which attackers accessed environment variables containing API keys and tokens stored as secrets for a limited number of accounts.

It is written for Fireworks customers who hold billing records or model files on the platform, and for developers who deploy open-source models there, including Mistral, Meta's Llama, and Google's Gemma. The account covers the early October notice to law enforcement and customers, the October 23 discovery, the data reached in the newer breach, and the October 24 unauthorized workload on development machines. It includes the credential, network, and storage changes made since the attack, the work with Palo Alto Networks' Unit 42, and LLMJacking cost figures that Google's Threat Intelligence Group and Mandiant published one week before Gatlan's report.

01Early October API keys and tokens

Fireworks notified law enforcement and customers of another security incident in early October after attackers accessed environment variables containing API keys and tokens stored as secrets for a limited number of accounts. Fireworks said at the time, "The evidence indicates links to a cybercriminal threat actor group, which is financially motivated and aimed at selling tokens from unauthorized access to Large Language Models (LLMs) to illicit routing gateways, known as 'LLMJacking'."

After revoking compromised internal credentials, affected Fireworks API keys, and keys created by the attackers, Fireworks discovered another security incident on October 23. The October 23 discovery is the newer breach in Gatlan's November 10 report, separate from the early October secrets incident.

02Billing records and model weights

Threat actors in the new breach accessed resource metadata for Fireworks resources, including resource identifiers, display names, descriptions, and creation time. They also accessed billing information: billing and shipping addresses, invoice and payment history, account balance, and credit usage. The same intrusion reached incomplete model weights and datasets belonging to some customers.

Fireworks said the attackers could not access customer payment card numbers because Fireworks does not store them. Billing and shipping addresses, invoice and payment history, account balance, and credit usage were still among the billing information the company said was accessed. The incomplete model weights and datasets that were reached belonged to some customers.

03October 24 development machine workload

Fireworks noted in a Monday advisory, "A third-party cloud provider that hosted Fireworks R&D machines experienced a security incident on October 23. On October 24, the unauthorized third party used it to reach Fireworks development machines and then run an unauthorized workload that led to additional customer data impact."

"We detected this activity on the same day, and followed our incident response processes to take immediate remediation measures and close known critical vulnerabilities," Fireworks said. "As of October 25, we have not detected further evidence of successful unauthorized access by the threat actor on the Fireworks platform customers use." Detection fell on October 24, the day the unauthorized workload ran.

October 23 is when the third-party cloud provider that hosted Fireworks R&D machines experienced the security incident. October 24 is when the unauthorized third party used that incident to reach Fireworks development machines and run an unauthorized workload. Fireworks said the workload led to additional customer data impact, that it detected the activity the same day, and that it then took immediate remediation measures and closed known critical vulnerabilities.

04Revoked accounts and closed pathways

Since the October 24 attack, Fireworks revoked and replaced credentials and service accounts. It restricted unauthorized network pathways and isolated affected systems. It tightened access to data storage and analytics systems to block public or unauthorized access to stored data.

The earlier revocation, done before the October 23 discovery, covered compromised internal credentials, affected Fireworks API keys, and keys created by the attackers. Fireworks said the later response closed known critical vulnerabilities and followed its incident response processes. As of October 25, the company had not detected further evidence of successful unauthorized access by the threat actor on the platform customers use.

05Unit 42 scope and LLMJacking costs

The company is now working with Palo Alto Networks' Unit 42 incident response division to secure its systems against future attacks and to investigate the incident's full scope and impact. The third-party cloud provider that hosted the Fireworks R&D machines is unnamed. The early October secrets exposure is described as a limited number of accounts, and the incomplete model weights and datasets as an exposure for some customers.

One week before the November 10 report, researchers at Google's Threat Intelligence Group (GTIG) and Mandiant reported that large language model hijacking attacks, also known as LLMjacking, are driving record costs for compromised organizations. Cloud AI charges cited by GTIG and Mandiant reached as high as $1 million due to fraudulent calls using stolen API keys. Fireworks had already used the name LLMJacking for the financially motivated group it linked to the early October incident, which it said was selling tokens from unauthorized access to LLMs to illicit routing gateways.