The first bulletin was reassuring in a specific way
On October 9, 2026, Fireworks AI told customers that an unauthorized party had used internal Fireworks credentials to read environment variables in evaluation jobs in a limited number of accounts, and then drew a line around the damage: based on the investigation at that time, the company had not detected evidence of unauthorized access to customer models, datasets, training data, personal information or inference traffic.
The November update adds categories that sat on that not-detected list. Fireworks now reports impacts to account and billing information, and says that for a limited set of accounts it discovered impact to secrets, datasets and incomplete models: in the bulletin's fuller wording, a subset of incomplete model weights and datasets were accessed. Customers whose data was impacted are being notified individually, with account-specific detail and recommended actions.
The second route ran through the development machines
The route matters as much as the data list. The original October incident began with internal credentials; Fireworks detected it on October 6, began notifying customers on October 7, rotated employee API keys on October 9 and revoked further user keys on October 10.
The update describes additional impact arriving by a different door. A third-party cloud provider that hosted Fireworks' research and development machines experienced a security incident on October 23. On October 24, the unauthorized party used that opening to reach Fireworks development machines and run an unauthorized workload. Fireworks says that workload led to additional customer-data impact. It detected the activity the same day, closed known critical vulnerabilities, and says that as of October 25 it had not detected further successful unauthorized access by the actor on the platform customers use.
What the update does not do is assign every accessed data category to a specific path. It identifies an affected internal application as the source of access to the listed categories, and separately describes the development-machine intrusion and the workload's additional impact. Fireworks reports no detected impact to Inference, Training SDK or Nexus, which it says are zero data retention by default.
What is confirmed, and what is still an investigation finding
Two parts of the update should be read at different strengths. The list of accessed categories is stated as discovery: Fireworks says it "discovered impacts" to billing information and, for a limited set of accounts, to secrets, datasets and incomplete models. The reassurances are stated as non-detection: no detected impact to the zero-retention services, and, as of October 25, no detected further successful access on the customer platform — both expressly based on an investigation that is still running and, in the company's words, may reveal additional information. The October bulletin used the same non-detection language about datasets, and the November update widened the finding. That history is a reason to treat the current non-detections as provisional rather than as clearance.
On attribution, Fireworks says the evidence indicates links to a financially motivated cybercriminal group aimed at selling tokens from unauthorized LLM access to illicit routing gateways, the pattern Google Threat Intelligence Group and Mandiant described as LLMJacking in research published on November 2, 2026. Beyond that link, the bulletin reports access to a subset of incomplete weights and datasets; it does not establish exfiltration, usability, resale or subsequent use, and readers should not fill those in.
What Fireworks customers should do with this
Read the two bulletins' guidance at their own dates. The October bulletin said that customers who had not received an affected-customer notice required no incident-specific action at that time; the November update says customers whose data was impacted are being notified, with account-specific detail. For notified customers, the October guidance stands: replace revoked Fireworks API keys, rotate the identified third-party credentials with the providers that issued them (deleting a stored secret does not invalidate the underlying credential), review the data and activity associated with exposed third-party credentials with those providers, and check API keys, users, evaluators, training jobs and datasets for anything unrecognized.
The operational consequence lands on customers who need the affected transfers. Self-serve dataset uploads and downloads used by Batch Inference and dataset-based training are disabled while the investigation continues, as of the November 9 bulletin, with no restoration date stated. Training SDK remains available under zero data retention, and Fireworks says its Lab-based training runs in an isolated environment with additional network and storage protection. Teams with batch or dataset-training work scheduled on Fireworks should plan around a transfer feature that is off until Fireworks publishes a restart.
Sources
- [1] Fireworks AI, "Update on October 2026 security incident", official security bulletin, last updated November 9, 2026Read source
- [2] Fireworks AI, "Fireworks October 2026 security incident", original official bulletin, published October 9, 2026, updated October 10, 2026Read source
- [3] Unite.AI, "Fireworks AI Expands Breach Disclosure to Datasets and Model Weights", November 9, 2026Read source