Fireworks

Fireworks AI Discloses Follow-Up Breach After Third-Party Cloud Provider Hack Exposes Customer Metadata and Partial Model Weights

Fireworks AI has reported a second security incident in October 2026 after a third-party cloud provider was breached, allowing attackers to reach the company's development machines. The threat actors accessed resource metadata, billing information, and incomplete model weights and datasets belonging to some customers. No customer payment card numbers were exposed because Fireworks does not store them. The company linked the activity to a financially motivated cybercriminal group focused on LLMjacking, the unauthorized use of stolen API keys to run large language models through illicit gateways. Fireworks responded by revoking credentials, isolating systems, and engaging Palo Alto Networks Unit 42 for further investigation. Earlier in the month the same group had obtained environment variables containing API keys and tokens from a limited number of accounts.