Fireworks AI Hack Exposed Customer Datasets and Billing Data
Fireworks, an AI platform used by about 10,000 businesses, now says attackers reached billing records and, for some accounts, datasets and model weights.
Hakkı ALKANPublished 3 min read
The Fireworks AI hack turned out to be bigger than the company first said. On Monday, Fireworks AI, an inference platform that runs and fine tunes AI models for businesses, said attackers reached customer billing records and, for a limited set of accounts, stored secrets, datasets and incomplete model weights.
That is a sharp change from early October, when Fireworks said only environment variables used in evaluation jobs had been exposed. Inference simply means running a trained model to get answers, and model weights are the learned numbers that make a model work, so leaked weights and training data are about as sensitive as it gets for an AI customer.
What data did the Fireworks AI hack expose?
According to the company's updated security bulletin, the affected internal application gave access to resource metadata such as identifiers, display names and descriptions, plus billing data including billing and shipping addresses, invoices, payment history, account balances and credit usage. Fireworks says it does not store payment card numbers, so cards were not affected.
For certain customers, a subset of incomplete model weights and datasets was also accessed. Fireworks says it has not seen any impact on its Inference service, Training SDK or Nexus, which keep no customer data by default (zero data retention), but it warns the investigation is ongoing.
| Affected | Not affected so far, per Fireworks |
|---|---|
| Billing and account data, resource metadata | Payment card numbers (not stored) |
| Secrets, datasets and incomplete model weights for some accounts | Inference, Training SDK and Nexus |
How did the attackers get in?
The story has two waves. On October 6, Fireworks found that internal credentials were being misused. Then, on October 23, a third party cloud provider hosting Fireworks research and development machines was breached, and on October 24 the attacker used that foothold to reach Fireworks development machines and run an unauthorized workload. Fireworks says it caught that activity the same day and has seen no successful access to the customer platform since October 25.
The company links the attack to a financially motivated group practicing "LLMjacking," which means stealing access to large language models and reselling the tokens through illicit gateways while the real account owner pays the bill. CEO Lin Qiao said on X in October that the attackers' behavior suggested AI agents were involved. Fireworks has notified law enforcement and is working with Palo Alto Networks Unit 42. It has also rotated credentials, isolated affected systems and paused self serve dataset uploads and downloads for Batch Inference and dataset based training.
Why does this matter beyond Fireworks?
Fireworks is not a niche player. Forbes reports that it has roughly 10,000 enterprise customers, including Uber, Shopify, Upwork and DoorDash, and a valuation of $17.5 billion. Forbes also spoke with two customers who had largely moved their work elsewhere, one of whom described "very bad hacks" of increasing frequency.
In our view, this is the hidden cost of cheaper custom AI. Companies that upload proprietary data to a fine tuning platform inherit that platform's attack surface, and here a breach at a cloud supplier was enough to open a path inward. It echoes the Northflank breach, where stolen AI API keys were abused, and the wider warnings about AI cyber attacks.
What should Fireworks customers do now?
- Rotate API keys and any secrets stored on the platform, even if you did not get a notice.
- Check billing and credit usage for unexpected spend, the classic sign of LLMjacking.
- Review which datasets you uploaded for batch jobs and whether they held personal or confidential data.
- Reply to your incident email or contact security-notice@fireworks.ai with questions.
If you only use Fireworks for live inference, the company says your traffic was not affected. If you trained custom models there, treat this as a reason to audit what you hand to any AI vendor.