On 9 November 2026, the AI inference provider Fireworks AI updated its security bulletin on two linked incidents from October. The update says attackers reached account and billing information and, for a limited set of accounts, secrets, datasets and incomplete model weights. Fireworks says its investigation is ongoing. For research groups that upload datasets or fine-tuning data to hosted AI platforms, the update is a concrete reminder of what a vendor-side compromise can reach.
What Fireworks says happened
- 6 October 2026: Fireworks says it identified unauthorized use of internal credentials and access to environment variables used in evaluation jobs, in a limited number of customer accounts. Its first bulletin said API keys and tokens stored as secrets were believed to have been captured, and reported no evidence at that stage of access to customer models, datasets or training data.
- 23 October 2026: a third-party cloud provider that hosts Fireworks R&D machines had a security incident.
- 24 October 2026: per the update, an unauthorized party used that incident to reach Fireworks development machines and run an unauthorized workload, causing additional customer data impact. Fireworks says it detected this the same day.
- 25 October 2026: Fireworks says it had not detected further evidence of successful unauthorized access to the platform customers use.
- 9 November 2026: Fireworks updated the bulletin with the data involved and its hardening measures.
What data was involved
According to the update, an affected internal application exposed resource metadata (resource IDs, display names, descriptions, creation times), billing information (billing and shipping addresses, invoice and payment history, account balance, credit usage), and, for certain customers, a subset of incomplete model weights and datasets. Fireworks states that payment card numbers are not stored by Fireworks and were not affected, and that it has not detected impact to its Inference, Training SDK and Nexus products, which it describes as zero data retention by default. It has not publicly said what “incomplete” means for the model weights or which datasets were involved.
Fireworks links the activity to a financially motivated group engaged in “LLMJacking” (selling access to LLMs obtained without authorization). It has notified law enforcement and engaged Palo Alto Networks Unit 42 for forensic analysis. As part of remediation it disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training while the investigation continues.
Customers named
Press reports quote a Fireworks statement that it is working with customers “including Notion, Cursor and others.” Notion has published its own notice saying Notion AI chat transcripts used for its Insights feature may have been exposed, that fewer than 1% of workspaces are affected, and that this is not a breach of Notion’s own systems. The Fireworks bulletins themselves name no customers, and we found no detailed public statement from Cursor.
What it means for research groups and universities
These points are editorial interpretation, not findings from the incident.
- Uploaded data sits in the vendor’s blast radius. Datasets and model weights stored for batch inference or fine-tuning can be exposed by an incident at the vendor or at the vendor’s own cloud provider, even if your own systems are untouched.
- Stored secrets are credentials. Fireworks’ first bulletin notes that removing a stored secret does not invalidate the underlying credential; rotation has to happen with the issuing provider. Any cloud, repository or data-access keys placed in hosted evaluation or training jobs should be treated as exposed if the vendor reports an incident.
- Zero data retention helps only where it applies. Fireworks says its ZDR products were not impacted, while dataset-based training and batch features were the ones paused. Research offices can ask vendors which services retain data and for how long.
- Check data-management plan and agreement terms. Review whether your data management plan, ethics approvals, data use agreements and funder conditions permit sending the data to a third-party hosted service, and whether the vendor must notify you of incidents. Human-participant, restricted-licence and export-controlled data deserve particular scrutiny. See also the research data management hub.
- Minimise what you send. De-identify or subset data, keep secrets out of jobs, and keep an inventory of which vendors hold which datasets so you can act quickly when a notice arrives.
Only customers who received an affected-customer notice are told by Fireworks to take incident-specific action; others are directed to contact the company at the addresses in its bulletins.
Sources
- Fireworks AI, “Update on the October 2026 security incident”, last updated 9 November 2026.
- Fireworks AI, “October 2026 security incident”, last updated 10 October 2026.
- BleepingComputer, “Fireworks AI discloses new breach after cloud provider hack”, 10 November 2026.
- Notion, “Notice about the Fireworks AI incident that may impact some Notion workspaces”.
