Fireworks AI has disclosed a second intrusion in October and a far wider exposure of customer data covering billing records, datasets and partial model weights.
How the attackers got in
A third-party cloud vendor behind the inference and fine-tuning provider’s research and development machines was compromised on October 23. Within a day the intruders had a route into Fireworks development systems, where an unauthorized workload ran and took far more than the company first believed.
The working theory points at crooks chasing money, the LLMJacking crowd that resells covert access through illicit gateways. Unit 42, Palo Alto Networks’ incident response arm, was brought in to clean up, a push that involved rotating credentials, cutting affected systems off the network and reworking storage permissions and monitoring.
Exposure was itemized per customer: resource metadata such as identifiers and descriptions, billing details including addresses, invoice history, balances and credit usage, plus partial model weights and datasets. Card numbers are not stored, so they were not affected.
Notion and Render among the downstream hits
Co-founder and CEO Lin Qiao pushed back on the idea that weights were the objective. Most downloads were partial and stopped, she said.
Fallout reaches past Fireworks’ own customers. Render CEO Anurag Goel shared a Notion notice saying his workspace sat among the under 1 percent that may have been hit, and that some unattributable chat sessions with Notion AI may have leaked. Notion insists no transcript says which user or workspace it belongs to, though the text itself can hold identifying detail.
Bloomberg reported Fireworks is helping Cursor and Harvey size up the fallout.
The shape of this one is familiar: the model provider was not the first victim, its hosting partner was. Audit what your cloud vendor can reach before someone else does.
