Fireworks AI discloses second breach: third-party cloud host used to reach R&D machines, exposing billing data, secrets, datasets and partial model weights
Matéria consolidada. Reúne 5 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 11/11/2026 00:02; os links antigos trazem para cá.
Fontes: thehackernews.com ↗ theregister.com ↗ gbhackers.com ↗ bleepingcomputer.com ↗
Fireworks AI, an inference platform for open-source models, disclosed on November 9, 2026 a second security incident within weeks (fireworks.ai, bleepingcomputer.com, thehackernews.com). A third party used a security incident at a third-party cloud provider hosting Fireworks R&D machines (reported as breached on October 23) to reach its development machines on October 24 and run an unauthorized workload (fireworks.ai, theregister.com). The provider is not named in the bulletin (fireworks.ai). Attackers accessed resource metadata and billing information, and for a limited set of customers also secrets, datasets and incomplete model weights. Payment card numbers were not affected because Fireworks does not store them (bleepingcomputer.com, fireworks.ai). The company links the activity to a financially motivated group practicing LLMJacking, which resells stolen LLM access through illicit routing gateways, but it has not named the group (fireworks.ai, gbhackers.com, theregister.com). Fireworks reports no further successful unauthorized access to the customer platform since October 25 and no impact on Inference, Training SDK or Nexus, which are zero data retention by default. It is working with Palo Alto Networks' Unit 42 on the full scope, and the findings may change (fireworks.ai, bleepingcomputer.com). It has also notified law enforcement, and the number of affected customers has not been disclosed (theregister.com). CEO Lin Qiao said the attackers were not after weights and that most downloads were partial and stopped (theregister.com). No CVE or software vulnerability is involved. In our assessment severity is high rather than critical, but the loss of datasets and model weights is serious (bleepingcomputer.com).
Detalhes técnicos
- The first incident was detected on October 6, 2026 at 9 a.m. PDT, and Fireworks published a notice about it on October 10 (thehackernews.com). It involved unauthorized use of internal Fireworks credentials and access to environment variables used in evaluation jobs. Those variables held API keys and tokens for a limited number of customer accounts (fireworks.ai, bleepingcomputer.com, thehackernews.com). The activity ran from October 6 to 9, and at the time Fireworks reported no access to models, datasets, training data, inference traffic or personal information (theregister.com).
- A third-party cloud provider hosting Fireworks R&D machines had a security incident on October 23. The unauthorized party used it to reach Fireworks development machines on October 24 (fireworks.ai, theregister.com).
- Fireworks says it detected the activity the same day and closed known critical vulnerabilities (bleepingcomputer.com, theregister.com).
- After the stolen internal credentials were used, the affected internal application exposed resource identifiers, display names, descriptions and creation times (fireworks.ai, gbhackers.com).
- Exposed billing data includes billing and shipping addresses, invoices, payment history, account balances and credit usage (fireworks.ai).
- For certain customers, a subset of incomplete model weights and datasets was accessed (fireworks.ai).
- Downstream exposure: Notion told Render that some Notion AI chat sessions may have been exposed. Notion said the transcripts were not linked to users or workspaces, though the chat content itself could contain identifying details (theregister.com).
- The vendor bulletin names no threat actor or malware family. bleepingcomputer.com quotes the October notice describing a financially motivated group selling LLM tokens to illicit routing gateways ('LLMJacking').
- No CVSS score, CVE or GHSA exists, because no software flaw has been published (gbhackers.com).
Remediação
- Fireworks revoked and replaced credentials and service accounts and removed unnecessary elevated privileges. It also restricted unauthorized network paths, isolated affected systems, tightened access to data storage and analytics systems, and strengthened logging and monitoring (bleepingcomputer.com, fireworks.ai, theregister.com).
- It disabled self-serve dataset uploads and downloads for Batch Inference and dataset-based training while the investigation continues. Training SDK remains available, and Lab-based training runs in an isolated environment (fireworks.ai, gbhackers.com).
- It notified law enforcement and works with Palo Alto Networks Unit 42 on the forensic investigation (theregister.com).
- Customers who received an affected-customer notice should replace revoked Fireworks API keys if they still need them. Customers without such a notice need no incident-specific action (fireworks.ai).
- Affected customers should also rotate third-party secrets with the issuing providers, update their applications, and review logs for unauthorized reads, downloads or changes (gbhackers.com).
- Deleting stored secrets does not invalidate the credentials. Customers should check users, evaluators, jobs, datasets and keys for unfamiliar activity (gbhackers.com).
Relatos divergentes
- Scope of the first incident: bleepingcomputer.com describes the October incident as covering environment variables with API keys and tokens for a limited number of accounts. theregister.com says that at the time Fireworks reported no access to models, datasets, training data, inference traffic or personal information. gbhackers.com stresses that the earlier bulletin reported only stolen environment variables, and that the November 9 update widened the scope to billing data, secrets, datasets and partial model weights. The November 9 update from fireworks.ai is the most recent and authoritative.
- Status of the investigation: bleepingcomputer.com says no further successful access was detected "as of October 25", while gbhackers.com says "since October 25". Fireworks itself says the findings are preliminary and may change, so the final scope is unconfirmed.
- Attacker objective: Lin Qiao says the attackers were not after weights and most downloads were partial and stopped (theregister.com), yet fireworks.ai confirms that incomplete weights and datasets were accessed for certain customers. The number of affected customers is undisclosed.
Linha do tempo
-
Fireworks AI Breach Widens to Expose Customer Billing Data and Incomplete Model Weights
ler a análise desta fonte ocultar
Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month uncovered further malicious activity, affecting account and billing information, alongside secrets, datasets, and incomplete models for a "limited set of accounts."
In a notice published on October 10, 2026, the company said it detected unauthorized use of internal Fireworks credentials that allowed an unauthorized third-party to access environment variables used in evaluation jobs in a limited number of customer accounts. The activity was detected on October 6, 2026, at 9 a.m. PDT.
-
Fireworks AI expands October breach: billing data, datasets and partial model weights exposed via cloud provider intrusion
ler a análise desta fonte ocultar
Fireworks AI expanded its disclosure on November 9, 2026, after an October intrusion that began with misused internal credentials and grew through a second path. The first stage, detected on October 6, let an attacker read environment variables in evaluation jobs, exposing API keys and tokens of some customers (theregister.com). The second stage began when a third-party cloud provider hosting Fireworks' R&D machines was breached on October 23, and the intruder used that foothold on October 24 to reach development machines and run an unauthorized workload (fireworks.ai). The exposed data covers resource metadata, billing records without payment card numbers, and, for a limited set of accounts, secrets, datasets and incomplete model weights (fireworks.ai). The company links the activity to a financially motivated group selling access to LLMs through illicit gateways, but has not named it, and reports no impact on its Inference, Training SDK and Nexus products (fireworks.ai). The investigation is ongoing and the number of affected customers has not been disclosed (theregister.com).
Technical Details
- Stage 1 (October 6 to 9): unauthorized use of internal credentials, with access to secrets used in evaluation jobs. At the time, Fireworks reported no access to models, datasets, training data, inference traffic or personal information (theregister.com).
- Stage 2 (October 23 to 25): the cloud provider's incident on October 23 was the entry point; the attacker's unauthorized workload ran on Fireworks development machines on October 24 and was detected the same day. As of October 25 no further successful access to the customer-facing platform had been detected (fireworks.ai). The bulletin does not name the cloud provider (fireworks.ai).
- Data categories: resource metadata (identifiers, display names, descriptions, creation times); billing data (billing and shipping addresses, invoices, payment history, balances, credit usage); and, for certain customers, a subset of incomplete model weights and datasets (fireworks.ai).
- Attacker objective: Fireworks CEO Lin Qiao said attackers were not after weights and that most downloads were partial and stopped (theregister.com).
- Downstream exposure: Notion told Render that some Notion AI chat sessions may have been exposed; Notion said the transcripts were not linked to users or workspaces, though the chat content itself could contain identifying details (theregister.com).
Remediation
- Fireworks' own actions: revoked and replaced credentials and service accounts, removed unnecessary elevated privileges, restricted unauthorized network paths, isolated affected systems, tightened access to storage and analytics, and strengthened logging and monitoring. It also disabled self-serve dataset upload and download for Batch Inference and dataset-based training while the investigation runs (fireworks.ai).
- Engagement: the company notified law enforcement and works with Palo Alto Networks Unit 42 on forensics and hardening (fireworks.ai).
- Customer actions (analyst recommendation): rotate any Fireworks API keys and any third-party secrets stored on the platform, since deleting a stored secret does not revoke the underlying credential; review jobs, datasets, users and keys for unfamiliar activity; and contact [email protected] (fireworks.ai).
-
Fireworks AI breach widens: billing data, customer secrets and partial model weights exposed in LLMjacking-linked intrusion
ler a análise desta fonte ocultar
Fireworks AI has widened its disclosure of an October 2026 intrusion. On November 9 it said attackers reached account and billing records and, for a limited set of accounts, secrets, datasets and incomplete model weights (fireworks.ai). The first detection was unauthorized use of internal credentials on October 6, and the earlier bulletin had reported only stolen environment variables used in evaluation jobs (gbhackers.com, fireworks.ai). A second intrusion began when a third-party cloud host running Fireworks' R&D machines was breached on October 23, and the intruder used that access to reach development machines on October 24 (fireworks.ai). The company links the activity to a financially motivated group practicing LLMJacking, which resells stolen LLM access through illicit routing gateways, but it has not named the group (fireworks.ai). The vendor reports no further attacker access to its customer platform since October 25 and no impact on Inference, Training SDK or Nexus, which are zero data retention by default (fireworks.ai). No CVE or software flaw is involved, so the risk comes from exposed credentials and data rather than a vulnerability score.
Technical Details
- The intruder used stolen internal credentials first, and the affected internal application then exposed resource identifiers, display names, descriptions and creation times (fireworks.ai, gbhackers.com).
- Billing data exposed includes billing and shipping addresses, invoices, payment history, account balances and credit usage. Payment card numbers are not stored and were not affected (fireworks.ai).
- For certain customers, a subset of incomplete model weights and datasets was accessed (fireworks.ai).
- The investigation is ongoing, and Fireworks says its findings are based on the investigation to date and may change (fireworks.ai).
- Neither the vendor nor the article gives a CVSS score, CVE or GHSA identifier, because no software vulnerability has been published for this incident.
Remediation
The vendor's bulletin describes operational hardening rather than a code fix, so no Fix Details section applies. Fireworks revoked and replaced credentials and service accounts, removed unnecessary elevated privileges, restricted unauthorized network paths, isolated affected systems, tightened access to storage and analytics, and strengthened logging (fireworks.ai). It disabled self-serve dataset uploads and downloads for Batch Inference and dataset-based training, while Training SDK remains available and Lab-based training runs in an isolated environment (fireworks.ai).
Affected customers should replace revoked keys, rotate third-party secrets with the issuing providers, update their applications, and review logs for unauthorized reads, downloads or changes (gbhackers.com). Deleting stored secrets does not invalidate the credentials, and customers should check users, evaluators, jobs, datasets and keys for unfamiliar activity (gbhackers.com). Questions go to [email protected] (fireworks.ai).
-
Fireworks AI discloses second breach in weeks, reached via third-party cloud provider hosting its R&D machines
ler a análise desta fonte ocultar
Fireworks AI, an inference platform for running open-source models, disclosed on November 9, 2026 a second security incident within weeks (fireworks.ai). The October incident involved unauthorized use of internal credentials and access to environment variables holding API keys and tokens for a limited number of customer accounts (fireworks.ai). In the new breach, a third party used a security incident at a third-party cloud provider hosting Fireworks R&D machines to reach Fireworks development machines on October 24 and run an unauthorized workload (fireworks.ai). The attackers accessed resource metadata, billing information and, for some customers, secrets, datasets and incomplete model weights, but not payment card numbers, which Fireworks does not store (bleepingcomputer.com). Fireworks says it had detected no further successful unauthorized access to the platform customers use as of October 25 and is working with Palo Alto Networks' Unit 42 on the full scope (bleepingcomputer.com). Criticity is high rather than critical: no vulnerability or CVE is involved, access relied on stolen credentials and a third-party foothold, exposure is limited to some accounts, and the vendor reports no further platform access, but the loss of datasets and model weights is serious.
Technical Details
- The first incident was identified on October 6 and involved unauthorized use of internal Fireworks credentials and access to environment variables used in evaluation jobs (fireworks.ai).
- A third-party cloud provider hosting Fireworks R&D machines had a security incident on October 23; the unauthorized party used it to reach Fireworks development machines on October 24 (fireworks.ai).
- Fireworks says it detected this activity the same day and closed known critical vulnerabilities (bleepingcomputer.com).
- The vendor's bulletin does not name a threat actor or malware family. The article quotes the October notice describing a financially motivated group selling LLM tokens to illicit routing gateways ('LLMJacking') (bleepingcomputer.com).
Remediation
- Fireworks revoked and replaced credentials and service accounts, restricted unauthorized network pathways, isolated affected systems and tightened access to data storage and analytics systems (bleepingcomputer.com).
- Fireworks states that customers who received an affected-customer notice should replace revoked Fireworks API keys if they still need them, and that customers without such a notice need no incident-specific action (fireworks.ai).
- Dataset transfers were reported as still disabled while the investigation continues (unite.ai).