Fireworks AI discloses second breach: third-party cloud host used to reach R&D machines, exposing billing data, secrets, datasets and partial model weights
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 10/11/2026 12:14; os links antigos trazem para cá.
Fireworks AI, an inference platform for open-source models, disclosed on November 9, 2026 a second security incident within weeks (fireworks.ai, bleepingcomputer.com). A third party used a security incident at a third-party cloud provider hosting Fireworks R&D machines to reach its development machines on October 24 and run an unauthorized workload (fireworks.ai). Attackers accessed resource metadata and billing information, and for a limited set of customers also secrets, datasets and incomplete model weights. Payment card numbers were not affected because Fireworks does not store them (bleepingcomputer.com, fireworks.ai). The company links the activity to a financially motivated group practicing LLMJacking, which resells stolen LLM access through illicit routing gateways, but it has not named the group (fireworks.ai, gbhackers.com). Fireworks reports no further successful unauthorized access to the customer platform since October 25 and no impact on Inference, Training SDK or Nexus, which are zero data retention by default. It is working with Palo Alto Networks' Unit 42 on the full scope, and the findings may change (fireworks.ai, bleepingcomputer.com). No CVE or software vulnerability is involved. In our assessment severity is high rather than critical, but the loss of datasets and model weights is serious (bleepingcomputer.com).
Detalhes técnicos
- The first incident was identified on October 6. It involved unauthorized use of internal Fireworks credentials and access to environment variables used in evaluation jobs. Those variables held API keys and tokens for a limited number of customer accounts (fireworks.ai, bleepingcomputer.com).
- A third-party cloud provider hosting Fireworks R&D machines had a security incident on October 23. The unauthorized party used it to reach Fireworks development machines on October 24 (fireworks.ai).
- Fireworks says it detected the activity the same day and closed known critical vulnerabilities (bleepingcomputer.com).
- After the stolen internal credentials were used, the affected internal application exposed resource identifiers, display names, descriptions and creation times (fireworks.ai, gbhackers.com).
- Exposed billing data includes billing and shipping addresses, invoices, payment history, account balances and credit usage (fireworks.ai).
- For certain customers, a subset of incomplete model weights and datasets was accessed (fireworks.ai).
- The vendor bulletin names no threat actor or malware family. bleepingcomputer.com quotes the October notice describing a financially motivated group selling LLM tokens to illicit routing gateways ('LLMJacking').
- No CVSS score, CVE or GHSA exists, because no software flaw has been published (gbhackers.com).
Remediação
- Fireworks revoked and replaced credentials and service accounts and removed unnecessary elevated privileges. It also restricted unauthorized network paths, isolated affected systems, tightened access to data storage and analytics systems, and strengthened logging (bleepingcomputer.com, fireworks.ai).
- It disabled self-serve dataset uploads and downloads for Batch Inference and dataset-based training while the investigation continues. Training SDK remains available, and Lab-based training runs in an isolated environment (fireworks.ai, gbhackers.com).
- Customers who received an affected-customer notice should replace revoked Fireworks API keys if they still need them. Customers without such a notice need no incident-specific action (fireworks.ai).
- Affected customers should also rotate third-party secrets with the issuing providers, update their applications, and review logs for unauthorized reads, downloads or changes (gbhackers.com).
- Deleting stored secrets does not invalidate the credentials. Customers should check users, evaluators, jobs, datasets and keys for unfamiliar activity (gbhackers.com).
Relatos divergentes
- Scope of the first incident: bleepingcomputer.com describes the October incident as covering environment variables with API keys and tokens for a limited number of accounts. gbhackers.com stresses that the earlier bulletin reported only stolen environment variables, and that the November 9 update widened the scope to billing data, secrets, datasets and partial model weights. The November 9 update from fireworks.ai is the most recent and authoritative.
- Status of the investigation: bleepingcomputer.com says no further successful access was detected "as of October 25", while gbhackers.com says "since October 25". Fireworks itself says the findings are preliminary and may change, so the final scope is unconfirmed.
Linha do tempo
-
Fireworks AI breach widens: billing data, customer secrets and partial model weights exposed in LLMjacking-linked intrusion
ler a análise desta fonte ocultar
Fireworks AI has widened its disclosure of an October 2026 intrusion. On November 9 it said attackers reached account and billing records and, for a limited set of accounts, secrets, datasets and incomplete model weights (fireworks.ai). The first detection was unauthorized use of internal credentials on October 6, and the earlier bulletin had reported only stolen environment variables used in evaluation jobs (gbhackers.com, fireworks.ai). A second intrusion began when a third-party cloud host running Fireworks' R&D machines was breached on October 23, and the intruder used that access to reach development machines on October 24 (fireworks.ai). The company links the activity to a financially motivated group practicing LLMJacking, which resells stolen LLM access through illicit routing gateways, but it has not named the group (fireworks.ai). The vendor reports no further attacker access to its customer platform since October 25 and no impact on Inference, Training SDK or Nexus, which are zero data retention by default (fireworks.ai). No CVE or software flaw is involved, so the risk comes from exposed credentials and data rather than a vulnerability score.
Technical Details
- The intruder used stolen internal credentials first, and the affected internal application then exposed resource identifiers, display names, descriptions and creation times (fireworks.ai, gbhackers.com).
- Billing data exposed includes billing and shipping addresses, invoices, payment history, account balances and credit usage. Payment card numbers are not stored and were not affected (fireworks.ai).
- For certain customers, a subset of incomplete model weights and datasets was accessed (fireworks.ai).
- The investigation is ongoing, and Fireworks says its findings are based on the investigation to date and may change (fireworks.ai).
- Neither the vendor nor the article gives a CVSS score, CVE or GHSA identifier, because no software vulnerability has been published for this incident.
Remediation
The vendor's bulletin describes operational hardening rather than a code fix, so no Fix Details section applies. Fireworks revoked and replaced credentials and service accounts, removed unnecessary elevated privileges, restricted unauthorized network paths, isolated affected systems, tightened access to storage and analytics, and strengthened logging (fireworks.ai). It disabled self-serve dataset uploads and downloads for Batch Inference and dataset-based training, while Training SDK remains available and Lab-based training runs in an isolated environment (fireworks.ai).
Affected customers should replace revoked keys, rotate third-party secrets with the issuing providers, update their applications, and review logs for unauthorized reads, downloads or changes (gbhackers.com). Deleting stored secrets does not invalidate the credentials, and customers should check users, evaluators, jobs, datasets and keys for unfamiliar activity (gbhackers.com). Questions go to [email protected] (fireworks.ai).
-
Fireworks AI discloses second breach in weeks, reached via third-party cloud provider hosting its R&D machines
ler a análise desta fonte ocultar
Fireworks AI, an inference platform for running open-source models, disclosed on November 9, 2026 a second security incident within weeks (fireworks.ai). The October incident involved unauthorized use of internal credentials and access to environment variables holding API keys and tokens for a limited number of customer accounts (fireworks.ai). In the new breach, a third party used a security incident at a third-party cloud provider hosting Fireworks R&D machines to reach Fireworks development machines on October 24 and run an unauthorized workload (fireworks.ai). The attackers accessed resource metadata, billing information and, for some customers, secrets, datasets and incomplete model weights, but not payment card numbers, which Fireworks does not store (bleepingcomputer.com). Fireworks says it had detected no further successful unauthorized access to the platform customers use as of October 25 and is working with Palo Alto Networks' Unit 42 on the full scope (bleepingcomputer.com). Criticity is high rather than critical: no vulnerability or CVE is involved, access relied on stolen credentials and a third-party foothold, exposure is limited to some accounts, and the vendor reports no further platform access, but the loss of datasets and model weights is serious.
Technical Details
- The first incident was identified on October 6 and involved unauthorized use of internal Fireworks credentials and access to environment variables used in evaluation jobs (fireworks.ai).
- A third-party cloud provider hosting Fireworks R&D machines had a security incident on October 23; the unauthorized party used it to reach Fireworks development machines on October 24 (fireworks.ai).
- Fireworks says it detected this activity the same day and closed known critical vulnerabilities (bleepingcomputer.com).
- The vendor's bulletin does not name a threat actor or malware family. The article quotes the October notice describing a financially motivated group selling LLM tokens to illicit routing gateways ('LLMJacking') (bleepingcomputer.com).
Remediation
- Fireworks revoked and replaced credentials and service accounts, restricted unauthorized network pathways, isolated affected systems and tightened access to data storage and analytics systems (bleepingcomputer.com).
- Fireworks states that customers who received an affected-customer notice should replace revoked Fireworks API keys if they still need them, and that customers without such a notice need no incident-specific action (fireworks.ai).
- Dataset transfers were reported as still disabled while the investigation continues (unite.ai).