Fireworks AI, a platform developers use to run open-source AI models, updated its security bulletin on November 9 to disclose a second breach on top of the one it announced in early October. In the first incident, which Fireworks says it identified on October 6, an attacker used internal credentials to read environment variables such as API keys and tokens stored as secrets in a limited number of customer accounts. The company now says the evidence points to a financially motivated group that sells access to large language model (LLM) tokens to illicit routing gateways, a practice known as “LLMjacking”, and that account and billing information was affected too. For a limited set of accounts, secrets, datasets and incomplete models were also hit.
The new incident began on October 23, when a third-party cloud provider that hosted Fireworks’ research and development machines was breached. On October 24, Fireworks says, the attacker used that provider to reach its development machines and run an unauthorized workload, leading to more customer data impact. The affected internal application exposed resource metadata (identifiers, names, descriptions, creation times), billing information (billing and shipping addresses, invoice and payment history, account balance, credit usage) and, for some customers, a subset of incomplete model weights and datasets. Fireworks says it does not store payment card numbers and has not detected impact to its Inference, Training SDK and Nexus products. It detected the activity the same day, had not detected further successful unauthorized access as of October 25, and is working with Palo Alto Networks’ Unit 42; its investigation is ongoing.
Notion, which used Fireworks for classification jobs behind its Insights feature and to serve open-weight models, published its own notice. It says Fireworks told it of an incident on November 2, that it disconnected from Fireworks by November 3, and that on November 6 Fireworks said customer data may have been accessed. After Fireworks confirmed the final dataset on November 8, Notion found it included Notion AI chat transcripts used for Insights. Notion says it affects fewer than 1% of workspaces, that the transcripts were unattributable for the vast majority of them, and that it contacted affected customers on November 9.
How to check if you’re affected
Affected products are Fireworks AI accounts (both incidents) and Notion workspaces whose AI chats were part of the dataset. Both companies say they notified affected customers directly: Fireworks says that if you have not received a notice, it has not identified your account as affected so far, and Notion says the same about workspaces.
If you received a Fireworks notice, its October bulletin lists these steps:
- Replace any revoked Fireworks API keys you still need, and update the applications that used them.
- Rotate the third-party credentials named in your notice with the providers that issued them; removing a stored secret from Fireworks does not invalidate the underlying credential.
- Review access logs for those credentials, and review API keys, users, evaluators, training jobs and datasets for anything you do not recognize.
If you received a Notion notice, Notion recommends treating the affected data as exposed and says that if you pasted passwords, API keys or other credentials into Notion AI during the incident period, you should rotate them. Notion says affected customers can retrieve and review the impacted data inside their workspace using instructions sent by email.