Fireworks AI breach reaches customer billing and model assets
Fireworks AI says attackers who reached its development machines on October 24 exposed customer billing data and, for a limited set of accounts, datasets and incomplete model weights. The expanded findings supersede the company’s October 10 assessment, which said it had found no evidence that customer models or datasets were accessed.
Fireworks traced the later activity to a third-party cloud provider hosting its research and development machines: attackers accessed the provider on October 23, then used that access the next day to reach Fireworks development systems and run an unauthorized workload. The company also reported access to resource metadata. Its earlier response revoked compromised credentials and rotated tokens, but did not establish the full scope of this separate route.
For customers whose assets sit in Fireworks, a hosted development environment proved to be a path to billing and model data, not just an isolated engineering workspace. Fireworks said it had found no further successful access to its customer platform as of October 25; how much data was reached through the development machines remains unclear.
Notion says Fireworks breach exposed customer AI chat transcripts
Notion, the digital workspace platform, disclosed that a security breach at its AI infrastructure provider, Fireworks AI, exposed Notion AI chat transcripts in a small number of workspaces.