🔍 Read the full analysis: Could The Fireworks AI Breach Affect Your AI Data Or Model Weights? on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Fireworks AI’s November 9 update says an incident that began in October reached account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. Notion says transcripts from its AI Insights feature may have been in an accessed dataset, affecting fewer than 1% of workspaces. The number of affected customers, the identity of the cloud provider and what happened to accessed data remain unclear.
Fireworks AI said in a November 9 security update that attackers accessed account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. The company’s revised account expands on an October notice that said it had not detected access to customer models or datasets. Notion separately said transcripts from its Notion AI Insights feature may have been included in a dataset attackers could access, affecting fewer than 1% of workspaces.
Fireworks, which provides infrastructure for running and fine-tuning open AI models, described two paths into its systems. In the first, attackers used internal Fireworks credentials to read environment variables from customer evaluation jobs. Such variables can contain credentials or tokens, though Fireworks’ update does not specify which particular secrets were accessed or how the internal credentials were first obtained.
Fireworks said a separate incident involving an unnamed third-party cloud provider affected machines used for research and development. The provider experienced a security incident on October 23. On October 24, an unauthorized party used the access to reach Fireworks development machines and run an unauthorized workload that led to additional customer data impact, according to Fireworks. The company said it detected this activity that day and has not detected further evidence of successful unauthorized access by the threat actor on the platform customers use since October 25.
The affected information listed by Fireworks includes resource metadata, billing and shipping addresses, invoice and payment history, account balances and credit usage. For certain customers, a subset of datasets and incomplete model weights was accessed. Fireworks did not define “incomplete” or say how many accounts were involved. It said it does not store payment card numbers and that those numbers were not affected. It also said it had detected no impact to its Inference, Training SDK and Nexus products, which it describes as zero data retention by default.
Notion said Fireworks first contacted it on November 2 about a dataset it initially understood to contain synthetic test data. On November 6, Fireworks told Notion that malicious actors may have accessed potential customer data; the dataset was confirmed on November 8, according to Notion’s advisory. Notion said chat transcripts from Notion AI Insights were in the dataset and that fewer than 1% of workspaces were affected. That figure is Notion’s account of its own exposure, not a total count across Fireworks customers.
Could the Fireworks AI Breach Affect Your Data or Model Weights?
Fireworks AI’s November update says the October incident reached account and billing information and, for some accounts, secrets, datasets and incomplete models. Access is reported; misuse or publication has not been confirmed.
What information may be affected
Reported access spans account records and, for a limited set of accounts, customer material.
Billing and resource details
Fireworks listed metadata, addresses, invoice and payment history, balances and credit usage.
Secrets, datasets and weights
Some accounts had secrets, datasets and incomplete model weights accessed. Fireworks has not defined “incomplete.”
AI Insights transcripts
Notion says transcripts may have been in an accessed dataset; its workspace figure does not represent all Fireworks customers.
How the incident unfolded
Fireworks described internal credential access and a separate incident involving an unnamed cloud provider.
What the disclosures establish
The statements describe access and possible exposure, but leave important questions open.
- Account and billing information was accessed.
- Some customer datasets, secrets and incomplete models were affected.
- Payment card numbers were not stored by Fireworks and were not affected.
- Total number of affected customers or accounts.
- Which secrets were accessed and what “incomplete” weights means.
- Whether accessed data was copied, retained, shared, published or used.
Risks for Customer Data and Models
The disclosure matters because Fireworks serves as infrastructure for other companies’ AI products and development work. A breach at a provider can expose information held or processed for customers, even when those customers did not directly operate the affected systems. In this case, the reported categories reach beyond account records: some customers may have had datasets, secrets or model weights accessed.
For companies that fine-tune models using proprietary data, model weights and datasets can form part of valuable technical assets. Fireworks said the affected weights were incomplete, but has not explained whether they were partial copies, unfinished training runs or something else. The update also does not establish that attackers used any accessed data, credentials or model material after obtaining it. Readers should distinguish reported access from confirmed misuse or publication: the available statements do not confirm what happened to the data after access.
Notion’s disclosure gives customers one concrete example of possible downstream exposure, but its workspace figure cannot be generalized to Fireworks’ full customer base. Fireworks has not published an overall affected-customer count. The incident also underscores the reliance AI companies place on cloud and development environments, where access can potentially connect internal machines to customer resources.
Products Worth Considering
Ledger Nano Gen5 Crypto Wallet, Black
Ledger Flex + Folio Crypto Hardware Wallet
LG UltraGear 32GS60QC-B 32-inch Curved QHD Gaming Monitor (180Hz, 1ms, 1000R, AMD FreeSync, HDR10)
As an affiliate, we earn on qualifying purchases.
From October Notice to Wider Scope
Fireworks’ first public bulletin, published October 9, described misuse of internal credentials and access to environment variables in a limited number of customer accounts. At that point, the company said it had not detected evidence of unauthorized access to customer models, datasets, training data, inference traffic, prompts, outputs or personal information. Its November 9 update says the investigation later found impact to account and billing information and, for some accounts, secrets, datasets and incomplete models.
Fireworks said it identified the initial activity on October 6 and began containment. It began notifying affected customers the next day, published its first bulletin October 9, and said it rotated employee API keys and revoked additional user keys and service-account tokens over October 9 and 10. The separate cloud-provider incident occurred later in October. Fireworks says it notified law enforcement and engaged Palo Alto Networks Unit 42 for forensic work.
As a precaution during the investigation, Fireworks said it disabled self-service dataset uploads and downloads used by Batch Inference and dataset-based training. Its November 9 update says the investigation remains ongoing and may produce additional information.
“For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models.”
— Fireworks AI, November 9 security update
Scope and Data Use Still Unknown
Fireworks has not named the third-party cloud provider, said how many customers or accounts were affected, or explained how attackers first obtained the internal credentials used in the earlier activity. It has also not detailed what “incomplete model weights” means, which particular secrets were involved, or whether accessed datasets contained production customer information in every case.
The companies have not publicly established whether stolen or accessed information was copied, retained, shared, published or used. Fireworks says it has detected no further successful access on its customer platform after October 25, but that statement does not by itself answer what happened to data accessed earlier. The investigation remains open, and the current disclosures do not provide a complete account of the affected Fireworks customer population.
Forensic Findings and Customer Notices
Fireworks says it is continuing its investigation with support from Palo Alto Networks Unit 42 and has notified law enforcement. It may issue further updates as investigators establish the scope and nature of the access. The company has also disabled certain self-service dataset functions while it investigates.
Customers should look for direct notices from Fireworks or their own service providers and review the specific categories named in those notices; the public information does not establish that every Fireworks customer was affected. Notion’s advisory provides a separate account for its workspaces, while the overall number of affected customers and any confirmed downstream use of the data remain unresolved.
Key Questions
Were all Fireworks AI customers affected?
No overall customer count has been disclosed. Fireworks said a limited set of accounts had impact to secrets, datasets and incomplete models, but has not said how many customers were affected. Notion’s figure of fewer than 1% applies to its own workspaces, not all Fireworks customers.
Were AI model weights stolen?
Fireworks said a subset of incomplete model weights was accessed for certain customers. It has not explained what “incomplete” means or said whether the material was copied or later used.
Could Notion AI chat transcripts be involved?
Notion said transcripts from its AI Insights feature were in a dataset that attackers may have accessed. Notion said fewer than 1% of its workspaces were affected. The public advisory does not establish what happened to those transcripts after access.
Were payment card numbers exposed?
Fireworks said it does not store payment card numbers and that card numbers were not affected. It did list billing information, including addresses, invoice and payment history, account balances and credit usage, among the accessed data categories.
What should customers watch for next?
Customers should watch for direct communications and further findings from Fireworks. The company says its investigation is ongoing; the cloud provider’s identity, the total number of affected accounts and the fate of accessed data have not been publicly clarified.
Source: ThorstenMeyerAI.com
