Fireworks AI Breach: What Happened, Who Is Affected, and What to Do Now

The Fireworks AI breach is now two connected incidents, and the second one pulled a household-name SaaS company into the blast radius. Fireworks, the Nvidia-backed AI inference platform, first disclosed unauthorized use of internal credentials on October 9, then updated that bulletin on November 9 after a third-party cloud provider hosting its R&D machines was itself breached, leading to customer data impact. Days later, Notion published its own advisory confirming that Notion AI chat transcripts were in the affected data and that on November 11 it revoked exposed Notion API keys found in those messages. This piece lays out the timeline from the primary sources, what was actually taken, and the response steps worth doing even if you never got a notification email. Source

The timeline, from both companies

The first incident started on October 6, when Fireworks identified unauthorized use of internal credentials: an unauthorized third party accessed environment variables, including API keys and tokens stored as secrets, used in evaluation jobs in a limited number of customer accounts. Fireworks began containment the same day, published its bulletin on October 9, and rotated employee API keys and service-account tokens. At that point it reported no detected access to customer models, datasets, training data, inference traffic, or personal information within its own security perimeter. Source

The second incident is the one that changed the picture. On October 23, a third-party cloud provider hosting Fireworks R&D machines had its own security incident, and on October 24 the attacker used that access to reach Fireworks development machines and run an unauthorized workload, which led to additional customer data impact. Fireworks says it detected this the same day, closed known critical vulnerabilities, and has seen no further successful unauthorized access on the customer-facing platform since October 25. Source

Notion's advisory fills in the downstream view. On November 2, Fireworks told Notion a small dataset had been accessed; Notion's initial read was that it held only synthetic testing data. On November 3, Notion disconnected its systems from Fireworks, deleted its data there, and stopped all communication between the two. On November 6, Fireworks said customer data may have been accessed after all; on November 8 it confirmed the final impacted dataset; on November 9 Notion began contacting affected customers, and on November 10 it published its advisory. Source

What was actually taken

Per Fireworks' November 9 update, the affected internal application exposed resource metadata (identifiers, display names, descriptions, creation times), billing information (billing and shipping addresses, invoice and payment history, account balance, credit usage), and, for certain customers, a subset of incomplete model weights and datasets. Payment card numbers are not stored by Fireworks and were not impacted. Fireworks says Inference, the Training SDK and Nexus are zero data retention by default and showed no impact. It has also disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training while the investigation continues. Source

For Notion, the impact is narrower but instructive. Fewer than 1% of Notion workspaces are affected, and the exposed data consists of Notion AI chat transcripts used by the Insights feature, which for the vast majority of impacted workspaces were unattributable, meaning not labeled with who wrote them or which workspace they came from, and containing no tool call results. Notion has disabled the Insights feature and stopped serving open-weight models through Fireworks. Source

The most concrete individual risk surfaced on November 11: during its investigation, Notion found exposed Notion API keys inside the affected user messages and revoked them. That is the part to internalize: people paste credentials into AI chats, and when those chats sit in a vendor's stored dataset, a vendor incident becomes a credential leak. Source

The motive: LLMJacking

Fireworks' update attributes the activity to a financially motivated cybercriminal group aimed at selling tokens from unauthorized access to large language models to illicit routing gateways, a pattern known as LLMJacking, and points to the November 2 Google Threat Intelligence Group and Mandiant write-up on the technique. In plain terms: stolen AI credentials are resold as compute, so the economics of stealing API keys now resemble the economics of stealing cloud credentials. Fireworks says it is working with Palo Alto Networks Unit 42 on forensics and has notified law enforcement. Source

How Fireworks responded

The update lists the hardening work done with Unit 42: revoking and replacing credentials and service accounts, removing unnecessary elevated privileges, tightening controls against new unauthorized credentials, restricting unauthorized network pathways and isolating affected systems, reviewing and tightening access to data storage and analytics systems, and securing logging and monitoring for forensic integrity. The response timeline on the original bulletin shows containment beginning the same day the first activity was identified, customer notifications starting the next morning, and credential rotations continuing through the following days. Source

One operational decision stands out for teams building on inference providers: Fireworks disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training for the duration of the investigation, while keeping the Training SDK available under zero data retention. If your workloads depend on those batch paths, that is a live service-availability consideration, not just a security one. Source

What to do now, even without a notification

Both companies say they have contacted every customer they identified as affected, so no email means no identified impact to date. There are still sensible steps. If your organization uses Notion AI and anyone may have pasted passwords, API keys or other credentials into chats during the incident window, rotate those credentials, as Notion itself recommends. If you are a Fireworks customer, review when your API keys were last rotated and whether any datasets or incomplete model weights were uploaded through the now-disabled self-serve paths. And if your security team has not read the Google and Mandiant LLMJacking research, it is the right week to do so. Source

Our read

This section is our assessment, not the companies' statements. Three lessons generalize. First, zero data retention is a property of specific pipelines, not of a vendor: the data that leaked from the Notion side existed because classification jobs for the Insights feature were stored outside the ZDR paths. Any "the vendor doesn't store anything" assumption needs to be verified per feature, per pipeline. Second, the blast radius ran through a chain of Fireworks, its third-party cloud provider, and Fireworks' development machines; fourth-party risk is now standard in AI infrastructure, and vendor reviews that stop at the direct provider miss it, a pattern we also covered in the litellm supply chain attack. Third, the API keys found inside chat transcripts are the quiet story here: secrets hygiene has to extend to what employees paste into AI tools, which is exactly the behavior gap the workos breach and least-privilege for AI agents posts approach from the identity side.

None of this is a reason to abandon AI vendors; it is a reason to contract and architect for the assumption that vendor incidents will happen: per-feature retention answers in writing, credential rotation runbooks that include AI chats, and monitoring for your own keys showing up where they should not.