Fireworks AI Says a Second Intrusion Reached Datasets and Model Weights

An unauthorized party that first took customers' stored secrets from Fireworks AI on October 6 later reached the company's development machines and took datasets and incomplete model weights for a limited set of accounts, Fireworks said in a bulletin updated on November 9. Notion, a Fireworks customer, said on its help site that Notion AI chat transcripts were among the data, and that fewer than 1% of Notion workspaces may be affected.

The flaw here is not a software bug but a chain of access: stolen internal credentials, then a compromised cloud provider, then a workload run on Fireworks development hardware. No CVE applies, and the attacker is not named.

What Fireworks said on October 9 and what it says now

Fireworks' original bulletin, last updated October 10 at 11:16 PDT, says it found unauthorized use of internal credentials on October 6 at 9am PDT. The third party "accessed environment variables used in evaluation jobs in a limited number of customer accounts." Those variables can hold API keys and tokens that customers stored as secrets.

That bulletin also said: "we have not detected evidence of unauthorized access to customer models, datasets, training data." The November 9 update says that for a limited set of accounts, secrets, datasets and incomplete model weights were accessed. The Register points out that the two statements do not agree, and that Fireworks chief executive Lin Qiao's remark that attackers "are not after weights" sits uneasily with the update.

The score question does not arise, since there is no CVE, but the scope question does. Fireworks has not said how many customers were affected by either intrusion.

The timeline, with dates

Date (2026)	Event	Source
October 6	Fireworks detects unauthorized use of internal credentials	Fireworks bulletin
October 9	First bulletin published; employee API keys rotated	Fireworks bulletin
October 23	A third-party cloud provider hosting Fireworks R&D machines has a security incident	Fireworks update
October 24	The unauthorized party reaches development machines and runs a workload	Fireworks update
October 25	Fireworks reports no further evidence of successful access to the customer platform	Fireworks update
November 3	Notion disconnects from Fireworks and deletes its data there	Notion help page
November 6	Fireworks tells Notion that actors "may have accessed potential customer data"	Notion help page
November 9	Fireworks publishes the broader update	Fireworks update

Fireworks does not name the cloud provider. The Hacker News dates the first bulletin to October 10, which matches the bulletin's own last-updated stamp; the bulletin's timeline places publication at 10pm PDT on October 9.

Data classes involved

The update lists three groups. Account and billing records cover billing and shipping addresses, invoice and payment history, account balance and credit usage. Resource metadata covers identifiers, display names, descriptions and creation times. The third group is secrets, datasets and incomplete model weights for the limited set of accounts.

Fireworks says payment card numbers are not stored and were not affected. It also says Inference, the Training SDK and Nexus show no detected impact, and that all three retain no data by default. The update adds that this may change as the investigation continues.

It attributes the activity to a financially motivated group that sells tokens from unauthorized model access to illicit routing gateways, a practice called LLMjacking. Palo Alto Networks Unit 42 is supporting forensics, and law enforcement has been notified.

Notion's side: Insights switched off

Notion's notice says it disconnected from Fireworks on November 3, deleted its data there and halted training runs. On November 8 Fireworks confirmed a new dataset to Notion, which found it held Notion AI chat transcripts used for the Insights feature.

The transcripts were not labelled with an author or workspace and "did not contain any tool call results," Notion says, so page content is not included. The Register quotes the founder of Render, Anurag Goel, as having been told his workspace was among those that may be affected, and notes that readers on Reddit argued unlabelled chats can still carry identifying details.

Notion has disabled Insights during its investigation and no longer serves open-weight models through Fireworks. Its advice is to treat the data "as if it were exposed" and rotate any password or API key anyone pasted into Notion AI. That echoes the question raised by the Gemini human-reviewer help page: what a user types into an assistant outlives the chat.

What customers should do

Fireworks' October guidance still applies to anyone who received a notice: create new API keys to replace revoked ones, and rotate every third-party credential listed in the notice with its issuing provider. The bulletin states that "Removing a stored secret alone does not invalidate the underlying credential." Then check provider logs for reads or downloads made with those credentials.

Fireworks has disabled self-serve dataset uploads and downloads for Batch Inference and dataset-based training while it investigates. Teams that run inference on hosted platforms should also compare this incident with the GPUStack authentication bypass for a self-hosted equivalent.

Customers who did not receive a notice are told no incident-specific action is required. The investigation is marked active monitoring as of November 9.

The open questions are the cloud provider's identity, the number of affected customers across both intrusions, and whether the Inference, Training SDK and Nexus statements survive further forensic work. Fireworks has not given a date for the next update.