Fireworks AI says attackers reached customer datasets, partial model weights and Notion AI chats

Fireworks AI runs the servers that thousands of AI apps quietly call when they want an open-weight model to answer. On 9 November it updated its October breach notice, and the list of what got touched grew a lot longer.

What happened

The company's first bulletin, on 9 October, said only secrets stored by Fireworks, such as those used in evaluation jobs, were known to have been accessed. The update adds a second route in. A third-party cloud provider that hosted Fireworks research and development machines had its own security incident on 23 October. The next day, the intruder used that foothold to reach Fireworks development machines and run an unauthorised workload. Fireworks says it spotted the activity the same day and has seen no further successful access to its customer platform since 25 October.

What got exposed

Account and billing information: billing and shipping addresses, invoice and payment history, account balances and credit usage. Resource metadata such as identifiers, names and descriptions. And for a limited set of accounts, secrets, datasets and a subset of incomplete model weights. Fireworks says it does not store payment card numbers, and that its inference, Training SDK and Nexus services, which keep no data by default, show no impact.

Notion, one of its customers, says fewer than 1% of its workspaces were affected. The exposed data included Notion AI chat transcripts used for its Insights feature. For most affected workspaces those chats were not labelled with who wrote them or which workspace they came from, and they did not include tool call results. Notion has disconnected from Fireworks, switched off Insights and stopped serving open-weight models through it. Fireworks says it is also working with Cursor and other customers.

Who's behind it

Fireworks links the attack to a financially motivated group that sells tokens from stolen access to large language models to illicit routing gateways, a scheme known as LLMjacking. It has notified law enforcement, brought in Palo Alto Networks Unit 42 for forensics, and paused self-serve dataset uploads and downloads while the investigation continues.

Our take

Your AI provider is part of your attack surface, and so is everything your users paste into the chat box. Notion's advice to affected customers says it plainly: if anyone pasted passwords, API keys or other credentials into an AI chat during the window, rotate them. Treat model vendors like any other data processor: know what you send them, keep it to the minimum, and have a plan to cut them off fast.