On November 9, 2026, Fireworks AI published an updated security bulletin on its October incident. After forensic work with Palo Alto Networks Unit 42, the company says billing information, secrets, datasets, and incomplete model weights were accessed for a limited set of accounts, beyond evaluation-job secrets known when the first bulletin went out in October. Fireworks links the activity to a financially motivated threat actor aimed at LLMjacking — reselling unauthorized LLM access through illicit gateways. If you stored provider keys, custom weights, or billing-linked metadata on Fireworks, rotate credentials, review inference logs, and read Fireworks' direct customer notice before trusting the platform with new secrets.
Wiz's Black October roundup listed Fireworks on October 6 as the first of nine AI developer platform incidents that month. This post follows Fireworks' own bulletin — not press summaries — for mechanism, scope, and remediation.
explainx.ai has the full news timeline for the November 9 vendor update and same-day trade coverage.
Update (November 10, 2026): Harvey, legal agents, and “second hack” headlines
Overnight and November 10 re-reporting did not change Fireworks' November 9 bulletin: scope, dates, and remediation wording match what we fetched again on November 10. What moved is customer naming and how outlets frame the timeline.
Bloomberg Law (November 9) quotes a Fireworks spokesperson on coordination with Notion and Cursor, and separately notes Fireworks' website lists Harvey (legal AI), Notion, and Cursor among 10,000+ customers. Harvey does not appear in the spokesperson quote — treat your tenant email from Fireworks as the scope source, not press customer lists.
Paywalled The Information coverage, summarized by MLQ on November 9, claims Fireworks told large customers including Harvey about a hack “more serious” than October's evaluation-secrets disclosure. Verified: Fireworks' public bulletin describes one October campaign with an October 23–24 third-party cloud path and expanded data categories — not a separate unpublished incident. Unverified without the full Information piece: whether any customer received a distinct private notice with different scope. MLQ notes it could not independently confirm a new incident beyond the bulletin when it checked.
For teams running legal or coding agents on Fireworks-backed models (Harvey-class products, Cursor, or custom LiteLLM routes), the operational delta from November 10 headlines is narrow: legal-agent vendors face the same key rotation, batch/dataset exposure questions, and LLMjacking log review as coding stacks. If your firm routes privileged matter text through any Fireworks tenant that used non-ZDR storage, escalate with vendor counsel using Fireworks' [email protected] channel, not trade headlines.
Update (November 9, 2026): Cursor named in customer response
Evening coverage adds who is coordinating with Fireworks and how large customers are reacting — context the bulletin itself does not name.
Bloomberg Law quotes a Fireworks spokesperson saying the company is “actively working with our customers to manage the incident, including Notion, Cursor, and others.” The piece frames the disclosure as a second serious intrusion in weeks, but both events trace to the same October 2026 campaign Fireworks expanded in its November 9 bulletin — not a separate unpublished breach.
Anna Tong at Forbes reports Fireworks has roughly 10,000 enterprise customers, names Cursor and Cognition among AI startups on the platform, and says two customers substantially moved their business off Fireworks after what one described as a series of “very bad hacks” with criticism of customer communications. Two other customers told Forbes they were not aware of hacks. Those accounts are customer interviews, not a second vendor scope statement — treat Fireworks' direct notice as authoritative for your tenant.
For teams that route Cursor-class coding products through Fireworks-hosted models, the takeaway is unchanged from the bulletin: rotate keys, watch downstream model logs, and do not assume inference-only traffic if you ever used dataset or batch features. If your org is evaluating a provider switch, factor in key migration in agent CI and any custom weights still on the vendor.
Update (November 10, 2026): Notion verifies Insights transcripts
Notion’s Help Center notice now confirms fewer than 1% of workspaces may be affected: unattributable Notion AI Insights chat transcripts on Fireworks without tool-call results—not full workspace exports. See Notion and Fireworks: agent-training dataset breach claims vs what is verified for the verified scope table and Security incident review steps.
TL;DR
| Question | Answer |
|---|---|
| Am I affected? | Customers Fireworks is notifying; assume exposure if you used non-ZDR features holding secrets, datasets, weights, or billing profiles |
| New vs October 9 bulletin? | Billing data, broader secrets/datasets/weights impact; Oct 23–24 third-party cloud path to R&D hosts |
| Inference / Training SDK / Nexus? | No impact detected — zero data retention (ZDR) by default per Fireworks |
| Payment cards? | Not stored by Fireworks; not impacted |
| Threat motive? | LLMjacking resale; cites Google GTIG and Mandiant (Nov 2 blog) |
| What to do? | Rotate keys, follow vendor email, disable dataset upload/download features until Fireworks re-enables |
Timeline
| Date | Event (per Fireworks and Wiz) |
|---|---|
| Oct 6, 2026 | Fireworks incident begins; listed first in Wiz Black October |
| Oct 9, 2026 | Fireworks publishes initial security bulletin; evaluation-job secrets known accessed |
| Oct 23, 2026 | Third-party cloud provider hosting Fireworks R&D machines reports security incident |
| Oct 24, 2026 | Unauthorized party uses that path to Fireworks development machines, runs unauthorized workload → additional customer data impact; Fireworks detects same day |
| Oct 25, 2026 | Fireworks reports no further successful unauthorized access on customer-facing platform |
| Nov 2, 2026 | Google GTIG and Mandiant publish LLMjacking report (cited by Fireworks) |
| Nov 9, 2026 | Fireworks publishes this expanded bulletin after Unit 42 forensics |
Fireworks notified law enforcement and engaged Unit 42 for forensic analysis per the November update.
Attack chain as Fireworks describes it
Public detail is still vendor-level, but the November bulletin adds structure:
Phase 1 — Initial October access
The original October incident involved access to Fireworks stored secrets used in evaluation jobs. That alone is enough to hunt downstream API keys if evaluations pulled live credentials.
Phase 2 — LLMjacking economics
Fireworks states evidence indicates links to a cybercriminal threat actor group that is financially motivated and aimed at selling tokens from unauthorized access to LLMs through illicit routing gateways — the pattern Google Threat Intelligence Group and Mandiant call LLMjacking. Beam summarized that report in LLMjacking at scale: Google and Mandiant on stolen LLM access.
The motive matters for defenders: attackers optimize for keys that invoke paid models, not for long-term persistence on a single SaaS UI.
Phase 3 — Third-party cloud provider pivot (Oct 23–24)
A third-party cloud provider hosting Fireworks R&D machines suffered its own incident October 23. October 24, the unauthorized party reached Fireworks development machines through that provider and ran an unauthorized workload that led to additional customer data impact.
Fireworks says it detected activity the same day, executed incident response, closed known critical vulnerabilities, and by October 25 saw no further successful unauthorized access on the customer-facing platform.
This is a supply-chain style path: compromise of a hosting partner adjacent to product R&D, then lateral movement into environments that held richer customer artifacts.
Data categories involved
Fireworks says an affected internal application exposed:
| Category | What Fireworks says was accessed |
|---|---|
| Resource metadata | Fireworks resource IDs, display names, descriptions, creation times |
| Billing information | Billing and shipping addresses, invoice and payment history, account balance, credit usage (payment card numbers not stored, not impacted) |
| Model artifacts | For certain customers, a subset of incomplete model weights and datasets |
The company is notifying impacted customers individually with recommended response actions.
What was not impacted (per Fireworks, investigation to date)
- Inference
- Training SDK
- Nexus
All three are zero data retention (ZDR) by default, meaning Fireworks says it does not persist customer payload data on those paths under normal operation. Fireworks notes the investigation is ongoing and may reveal more.
Product changes during response
Fireworks disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training while investigating.
- Training SDK remains available with ZDR (no training data at rest).
- Fireworks Lab-based training runs in an isolated environment with extra network and storage protection.
What Fireworks says it fixed
Working with Unit 42, Fireworks lists security hardening:
- Access and credential lockdown — revoked and replaced credentials and service accounts, removed unnecessary elevated privileges, tightened controls against new unauthorized credentials.
- Network isolation — restricted unauthorized network pathways and isolated affected systems.
- Data protection — tightened access to data storage and analytics; enforced controls against public or unauthorized access.
- Forensic and audit integrity — secured and enhanced logging and monitoring.
Fireworks continues 24/7 monitoring and may publish further updates.
Contact: reply to incident notification email or [email protected].
What this means if you run AI coding agents
Coding agents do not run on Fireworks, but teams wire Fireworks API keys into scripts, eval harnesses, and CI the same way they wire OpenAI or Bedrock keys. October's industry pattern — documented by Wiz and in Northflank's control-plane incident write-up — is hunt stored environment variables with AI scope. Fireworks' expanded disclosure adds weights and datasets, which matters if you treated the platform as temporary GPU rental but stored proprietary checkpoints there.
Rotate and narrow
- Rotate every key Fireworks could read — cloud provider keys, model vendor keys, webhook secrets, and eval credentials. Prioritize keys with invoke permissions and high quotas. Use GitBook-style reauth patterns if agents cached tokens locally.
- Review provider logs for model calls you did not make; Wiz documented first abuse within 30 minutes in two Black October cases.
- Treat incomplete weights and datasets as leaked IP — assume competitors or distillation actors could copy partial artifacts unless Fireworks' customer notice says otherwise for your account.
- Prefer ZDR paths Fireworks labels as non-impacted for new work until the bulletin closes investigation gaps.
- Do not paste live keys into agent sessions while rotating; use short-lived tokens and scoped agent key hygiene guidance.
What Beam can and cannot do here
Beam runs on your machine and does not see Fireworks' cloud control plane. It can help with the local half of the response:
- Flag risky agent actions — destructive commands and credential exposure in what agents read, print, or send via workspace watches.
- Scan skills and MCP configs before you run them — eleven heuristic patterns plus MCP version-pin checks catch common secret-exfil shapes, though they are not a substitute for vendor-side breach cleanup.
- Redact known credential formats before events persist locally when you use the collector.
Beam cannot tell whether Fireworks lost your weights, cannot revoke Fireworks-side keys for you, and cannot replace vendor notifications. Treat Fireworks' email as authoritative for your tenant.
How this compares to other October platforms
Wiz's Black October post emphasized credential hunting across nine platforms without one shared CVE. Fireworks' November bulletin is unusually specific about LLMjacking alignment and model artifact exposure — closer to the economic model Google documented than to a single-library supply-chain bug.
If your team standardized on one inference vendor during October, this update is a reason to split keys by environment, cap spend, and keep custom weights on storage you control unless ZDR terms are contractually clear.
Mapping Fireworks product surface to your agent workflow
Fireworks' November bulletin draws a bright line between persistent internal applications (where billing profiles, datasets, and incomplete weights lived) and ZDR inference/training paths. Use this mapping when deciding what to rotate:
| Fireworks surface | Data retention (vendor claim) | Practical agent-team question |
|---|---|---|
| Inference API | ZDR by default | Did you only call models with ephemeral payloads? Lower artifact risk, keys still in scope. |
| Training SDK | ZDR — no training data at rest | Did CI store Fireworks tokens in env vars on the runner? Rotate those tokens. |
| Nexus | ZDR by default | Same as Inference — key exposure dominates. |
| Batch Inference with datasets | Upload/download disabled during investigation | Did you upload proprietary JSONL or checkpoints? Treat as exposed until notified otherwise. |
| Dataset-based training | Upload/download disabled | Assume partial weights copies are in attacker hands if Fireworks emailed you. |
| Lab-based training | Isolated environment per bulletin | Confirm whether your tenant used lab mode or shared batch storage. |
| Evaluation jobs (October) | Secrets known accessed early | Re-run evaluations only after rotating every secret those jobs could reach. |
Agents do not understand vendor retention labels. Your runbooks should: store provider keys in a secret manager with per-environment scopes, never in repository .env files agents can read, and log which Fireworks endpoint each job used so incident response can answer "were we on ZDR or batch storage?" in minutes instead of days.
Detection signals after a platform-side breach
Fireworks' customer notifications are authoritative, but you can cross-check locally:
- Cloud model logs — spikes in
InvokeModel,chat.completions, or vendor-equivalent calls from unfamiliar regions; align with GTIG's note thatmax_tokens=1probes precede large spends (LLMjacking report summary). - Billing alerts — Fireworks credit usage jumps or cloud invoices rise while engineering headcount is flat.
- Git history — search for committed Fireworks API keys or dataset upload scripts referencing disabled batch features.
- Agent transcripts — if you log local agent sessions, grep for pasted
fw_or Fireworks-style tokens after the October window.
Wiz's October telemetry showed first unauthorized resell calls within 30 minutes in documented Black October cases. Shorter detection windows beat waiting for monthly finance review.
Third-party host risk and agent supply chains
The October 23–24 path through a cloud provider hosting R&D machines is a reminder that AI vendors inherit their hosts' incident timelines. Coding agents increasingly depend on nested SaaS: IDE → CI → inference vendor → bare-metal partner. Compromise any hop that stores long-lived credentials and the agent layer looks fine while keys leak underneath.
Mitigations that transfer to agent operations:
- Assume platform breach equals key breach until the vendor names your tenant cleared.
- Issue one key per agent workflow so revocation is surgical.
- Keep weights and eval sets on object storage you control, using inference only for compute, matching the ZDR posture Fireworks says was unaffected.
Related reading
-
Hugging Face warns open AI hubs are prime agent targets — Solaiman cites this Fireworks incident alongside the July HF swarm (November 2026).
-
NEAR AI cloud inference pause after internal unauthorized access
Frequently asked questions
What did Fireworks disclose on November 9, 2026?
Fireworks updated its October 2026 security bulletin to say billing information, secrets, datasets, and incomplete model weights were accessed for a limited set of accounts, beyond evaluation-job secrets known in October. It attributes activity to a financially motivated group aligned with LLMjacking resale.
Which Fireworks products were not impacted?
Fireworks says it has not detected impact to Inference, Training SDK, or Nexus, which are zero data retention by default. Payment card numbers are not stored and were not impacted.
What happened on October 23–24?
A third-party cloud provider hosting Fireworks R&D machines had a security incident on October 23. On October 24, an unauthorized party used that path to reach Fireworks development machines and run an unauthorized workload with additional customer data impact. Fireworks says it detected the activity the same day and closed critical vulnerabilities by October 25.
Did Fireworks disable any features?
Fireworks disabled self-serve dataset uploads and downloads for Batch Inference and dataset-based training while investigating. Training SDK remains available with zero data retention, and lab-based training runs in an isolated environment with added network and storage controls.
What should I do if I used Fireworks for custom models or keys?
Rotate every API key and secret the platform could read, review cloud and model-provider logs for abuse, and follow Fireworks customer notifications. Treat incomplete weights and datasets as potentially exposed intellectual property.
How does LLMjacking relate?
Fireworks cites Google Threat Intelligence Group and Mandiant reporting on LLMjacking — reselling stolen LLM access through illicit routing gateways. Wiz and Google documented similar economics in October and November 2026.
Fireworks bulletin wording and dates reflect the vendor page as of November 10, 2026.