Fireworks AI used a November 9 update to widen its disclosure of an October security incident. The company first found unauthorized use of internal credentials on October 6; the update adds a second path — a third-party cloud provider hosting Fireworks R&D machines was breached on October 23, and the next day the intruder used it to reach Fireworks development machines and run an unauthorized workload. Fireworks says it detected that activity the same day and has seen no further successful access on its customer platform since October 25.

The expanded impact list covers account and billing information — billing and shipping addresses, invoice and payment history, account balances and credit usage — and, for a limited set of accounts, secrets, datasets and a subset of incomplete model weights. Payment card numbers are not stored by Fireworks and were not affected, and the company says it has detected no impact to Inference, the Training SDK or Nexus, which are zero data retention by default, though the investigation is ongoing.

Fireworks has disabled self-serve dataset uploads and downloads while the investigation continues, brought in Palo Alto Networks Unit 42, and notified law enforcement. It links the activity to a financially motivated group engaged in LLMjacking — reselling unauthorized access to large language models.