Fireworks AI’s Second Breach Reached Customer Model Weights
Fireworks AI says a second intrusion, found on 24 October, reached billing records and, for some customers, unfinished model files. The company updated its security bulletin on 9 November.
A second break-in at Fireworks AI reached billing records and, for some customers, unfinished copies of their AI models. The attackers got in on 24 October through a security incident at a third-party cloud provider. Fireworks published the findings on 9 November.
Fireworks hosts other companies’ AI models and helps them train specialised versions. The new details are in an update to its October security bulletin. It has not named the cloud provider or how many accounts were affected.
Two incidents in three weeks
On 6 October, Fireworks found unauthorised use of its own internal credentials. An attacker had reached API keys and other secrets used in evaluation jobs in a limited number of customer accounts. In a bulletin published on 9 October, it said it had not then found access to customer models, datasets or personal information. Further work with Palo Alto Networks Unit 42, and a report to law enforcement, changed that. Fireworks later found access to billing information and, for some accounts, to secrets, datasets and incomplete models.
What the 24 October intrusion reached
On 23 October a third-party cloud provider that hosted Fireworks research machines had its own security incident. The next day, the unauthorised party used that opening to reach Fireworks development machines and run a workload that exposed more customer data. Fireworks says it spotted this the same day, and has seen no further successful access to the customer platform since 25 October.
The application they reached held resource names, billing and shipping addresses, invoice history, account balances and credit usage, and, for some customers, unfinished model files and datasets. Model files, often called weights, are the learned data that make an AI model work. Payment card numbers are not stored by Fireworks and were not affected. It also reported no impact on its live inference service, which runs models for customers.
Linked to a theft-for-resale trade
Fireworks says the evidence points to a financially motivated group that sells stolen access to large AI models through illicit routing gateways, known as LLMJacking. On 2 November, Google’s Threat Intelligence Group and Mandiant described that trade, and said some victims were run up more than $100,000 in a day, with bills at some organisations reaching $1 million. DailyAI covered that research.
Fireworks has revoked and replaced credentials, isolated affected systems, and turned off self-serve dataset uploads and downloads while it investigates. It is notifying affected customers.
Why it matters: Firms that send unfinished models to an AI host are also trusting that host’s cloud suppliers. A break-in at one supplier was enough to reach some customers’ model files, which cannot be taken back the way an API key can be replaced.
