TL;DR
Fireworks AI says attackers accessed account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. Notion says chat transcripts from its AI Insights feature were in a dataset attackers may have accessed; it estimates fewer than 1% of workspaces were affected.
Fireworks AI said on November 9 that attackers accessed account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models during security incidents in October. The update widens the scope described in the company’s October notice and matters to businesses that used Fireworks to run or fine-tune AI models.
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Fireworks said the first activity involved someone using internal Fireworks credentials to read environment variables from customers’ evaluation jobs. These settings can contain sensitive values such as API keys and tokens. The company said it identified the activity on October 6 and began containment, then started notifying affected customers the following day. It published its initial security bulletin on October 9.
A second access route emerged later in October. Fireworks said a third-party cloud provider hosting its research and development machines experienced a security incident on October 23. On October 24, an unauthorized party used that access to reach Fireworks development machines and run an unauthorized workload that led to additional customer data impact. Fireworks said it detected this activity that day. It reported no further evidence of successful access to the customer platform after October 25.
The company lists resource metadata and billing information among the data accessible through an affected internal application. Billing details included billing and shipping addresses, invoice and payment history, account balances and credit usage. Fireworks said payment card numbers were not affected because it does not store them. It also said it had not detected an impact to Inference, Training SDK or Nexus, which it describes as zero data retention by default.
Risks for AI Customer Data
The expanded scope matters because organizations may send proprietary datasets, credentials and model artifacts to an AI infrastructure provider as part of development and testing. Exposure of a dataset or incomplete model could create business and privacy concerns even if a finished production model or live inference traffic was not affected. The details in Fireworks’ update do not establish that every listed category was accessed for every customer.
Notion has identified a possible downstream effect for its own customers. It said chat transcripts from Notion AI Insights were included in a dataset that attackers may have accessed, and estimated that fewer than 1% of workspaces were affected. That estimate is Notion’s account of its exposure; the available information does not identify the users or workspaces involved.
For customers, the practical concern is whether their particular account, credentials or data were in the affected set. Fireworks says it notified affected customers, but its public update does not provide a total number of customers or accounts involved. Companies using the platform may need to check provider notifications and review whether any exposed secrets require action.
Products Worth Considering
Bose SoundLink Max Portable Bluetooth Speaker, IP67 Waterproof and Dustproof, Up to 20 Hours of Battery Life, Black
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
Bose QuietComfort Wireless Noise-Cancelling Headphones, Cypress Green
As an affiliate, we earn on qualifying purchases.
From October Notice to Update
Fireworks’ October 9 bulletin described a narrower picture. The company said it had not detected evidence of unauthorized access to customer models, datasets, training data, inference traffic, prompts, outputs or personal information. It said the initial activity involved internal credentials and environment variables in a limited number of customer accounts.
That account changed as Fireworks investigated. In its November 9 update, it said it had since discovered impacts to account and billing information, plus access to secrets, datasets and incomplete models for a limited set of accounts. The company said it rotated employee API keys on October 9, revoked more user API keys and rotated service-account tokens on October 10, and detected the later cloud-provider-related activity on October 24.
Notion said Fireworks first contacted it on November 2 about a dataset it later determined was synthetic test data. On November 6, Fireworks told Notion that malicious actors may have accessed potential customer data; on November 8, it identified the dataset containing Notion transcripts. Fireworks said it notified law enforcement and engaged Palo Alto Networks Unit 42 to assist with forensic work.
“For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models.”
— Fireworks AI
Scope Still Under Investigation
Several details remain unavailable publicly: the identity of the cloud provider, the number of affected customers, how the internal credentials were first obtained, and what happened to data that attackers accessed. Fireworks has not explained what “incomplete models” means or specified how much of any model artifact was involved.
The company says its investigation is ongoing and may uncover more information. Its statements that certain products were not affected and that it found no later successful access describe the current findings it has reported; they do not resolve every question about the incidents. The public material also does not say whether attackers copied, retained or shared the accessed data.
Customer Notifications and Findings
Fireworks says it has notified affected customers and is continuing its investigation with Unit 42. Further details may clarify the number of accounts involved, which data categories applied to each customer, and the nature of the incomplete model artifacts. Customers who receive a notice can use it to determine whether credentials, datasets or billing records associated with their account were involved.
Notion has described its own review of the dataset and estimated the share of potentially affected workspaces. Further information from either company could refine that assessment. For now, the public disclosures establish an expanded breach scope, while the full reach and disposition of accessed data remain unknown.
Key Questions
What information does Fireworks AI say attackers accessed?
Fireworks lists resource metadata and billing information, and says that secrets, datasets and incomplete models were affected for a limited set of accounts. It has not published a total customer count.
Were payment card numbers exposed?
Fireworks says it does not store payment card numbers and that they were not impacted. It did list other billing details, including addresses, invoice history, account balances and credit usage.
Were Notion AI transcripts involved?
Notion said chat transcripts from its AI Insights feature were in a dataset attackers may have accessed. It estimated fewer than 1% of workspaces were affected.
What does Fireworks mean by incomplete models?
The company has not publicly explained the term. Its update says a subset of incomplete model weights was accessed for certain customers, without describing how complete the files were or what they contained.
Which Fireworks products were affected?
Fireworks says it has not detected an impact to Inference, Training SDK or Nexus, which it describes as zero data retention by default. It says its investigation is ongoing.
Source: Thorsten Meyer AI
