Fireworks Says October Credential Abuse Also Hit Customer Datasets and Incomplete Weights

Fireworks AI's later bulletin revises the October 10, 2026 notice. On October 6 at 9 a.m. PDT it detected unauthorized use of internal credentials against environment variables in evaluation jobs, capturing API keys and tokens for a limited set of accounts. The first notice said models, datasets, training data, inference traffic, and personal data were not accessed. The update says the actor reached R&D machines on October 23 via an unnamed third-party cloud host, then on October 24 ran an unauthorized workload that widened customer-data impact. As of October 25, Fireworks reported no further successful access on the customer platform.

Exposed classes named by Fireworks are resource metadata, billing and shipping addresses, invoice and payment history, balances, credit usage, and a subset of incomplete model weights and datasets for certain customers. The company says card numbers are not stored and were not exposed, and that it is alerting affected accounts. Controls cited are credential revocation and rotation, system isolation, tighter access, and improved logging. Absent from the public record: the third-party cloud vendor, a customer count, a CVE, and any independent forensic write-up. Scope language is still the vendor's, not a measured inventory.

Fireworks assesses a financially motivated criminal group selling stolen LLM access into illicit routing gateways. That matches the LLMjacking pattern Sysdig documented in May 2024: stolen cloud credentials used to burn model quota while the victim pays. The Hacker News piece also cites a recent Google warning on AI-infrastructure targeting in finance, retail, technology, and transportation across three regions. Treat that as company claim plus secondary reporting. No malware family, infrastructure overlap, or payment trail is public, so an outside analyst cannot confirm the group or the resale motive. Official attribution is not technical confirmation.

The miss in early coverage is calling this a single-vendor secret spill. Evaluation-job environment variables were the hinge: one internal credential exposed customer API keys, then a separate cloud-hosted R&D path reached incomplete weights and datasets. Notion says under 1 percent of workspaces were hit, after first citing synthetic test data and later possible customer data. A Reddit claim that everyone is inside that 1 percent is anecdote, not a census, but percentage framing without a denominator is not a scope. Customers should not treat key rotation as the full loss if weights or chat-derived data left the tenant.