Fireworks AI Says Second Breach Reached Customer Billing Data

What happened

Fireworks AI, a platform that lets developers run and train AI models, has disclosed a second security incident from October 2026. In an update published on 9 November, the company said a third-party cloud provider that hosted its research and development machines was breached on 23 October. The next day, according to the company, the intruder used that access to reach Fireworks development machines and run an unauthorised workload that affected more customer data.

The exposed information goes beyond the first incident. The Hacker News reports that billing information was among the data accessed. For a limited set of accounts, the company says secrets, datasets and incomplete model weights were also reached. Fireworks says payment card numbers were not affected because it does not store them. The company has not said how many accounts were involved, and it has not named the cloud provider.

How the two incidents connect

The first incident is older. Fireworks says it identified unauthorised use of internal credentials on 6 October 2026. The intruder could read environment variables used in evaluation jobs for a limited number of customer accounts, which can include API keys and tokens. Fireworks published its first bulletin on 9 October and later revoked the affected keys.

Fireworks says evidence links the early October incident to a cybercriminal group that is financially motivated and sells access to large language models, a practice known as LLMjacking. According to Insurance Journal, the company did not say who was responsible for the second intrusion.

What Notion reported

Notion, the workspace software company, is one of Fireworks' customers. Notion said fewer than 1% of its workspaces had Notion AI chat transcripts exposed through the incident. According to Notion, the transcripts were used for its Insights feature and, for most affected workspaces, were not linked to a user or workspace. Notion has disabled Insights and stopped serving open-weight models through Fireworks. The Record reports that Notion was notified on 2 November, which is earlier than the date of Fireworks' update.

Why this matters for businesses that automate work

Automated workflows depend on keys and logins. A key that lets an invoice tool or a reporting script call an AI model works like a password, and it often sits in several places at once. When a model host is breached, every business that stored a key with that host has to treat the key as possibly exposed, even if its own systems were never touched.

Billing data is a second concern. Invoice histories, balances and billing addresses are the details a fraudster needs to write a believable message about changed bank details. Finance staff who receive payment-change requests from suppliers or from the platform itself need a clear verification step.

Notion's case shows a related risk. Its users may never have contracted directly with Fireworks, yet data passed through it because Notion used Fireworks for some AI features. Businesses that use software with AI features should ask which model providers sit behind those features.

What changes in practice

For a business of any size, the first step is an inventory. List every tool, script and automated workflow that holds an API key or token for an AI platform, and check whether any of them received a vendor notice. Fireworks says the API keys it revoked no longer work, and it asks affected customers to rotate third-party credentials named in their notice and update the applications that use them.

Next, look at what people type into AI tools. Notion advises customers to rotate any password, API key or other credential that was pasted into Notion AI during the affected period. The same habit applies to any chat assistant. Staff should be told not to paste credentials into prompts.

Finance teams should add a call-back check before any change to supplier bank details is accepted, whether the request arrives by email, chat or a platform notice. Vendors should also be asked, in writing, where your data is stored, how long it is kept and which third parties host it.

Automation can help here. A scheduled job can list every key with its age and owner, flag keys tied to a vendor notice and open a task for the person who must rotate it. It cannot judge whether a chat contained a password, decide whether a supplier is still trusted, or approve a change to a bank account. A person still makes those decisions.

What to watch next

Fireworks says it is still working with Palo Alto Networks Unit 42 to investigate the full scope of the intrusion. It has also disabled self-serve dataset uploads and downloads used for Batch Inference and dataset-based training while the investigation continues. Businesses should watch for a count of affected accounts, a named cloud provider and any change to those dataset features. Further updates are expected on the Fireworks security bulletin page.