Fireworks AI breach reached customer datasets and model weights

Fireworks AI says the security incident it disclosed in October was bigger than it first reported. In an update to its security bulletin on Monday, the AI inference company said the threat actor reached account and billing information and, for a limited set of accounts, secrets, datasets and incomplete model weights.

Fireworks links the attack to a financially motivated cybercriminal group that sells tokens from unauthorised access to large language models to illicit routing gateways, a scheme known as LLMJacking. It points to a report on LLMJacking that Google Threat Intelligence Group and Mandiant published on November 2. The company has notified law enforcement and brought in Palo Alto Networks Unit 42 for the forensic work.

Two intrusions

The first bulletin, published on October 9, described unauthorised use of internal Fireworks credentials found on October 6. In that incident a third party captured environment variables, including API keys and tokens stored as secrets, used in evaluation jobs in a limited number of customer accounts. Fireworks then said it had seen no access to customer models, datasets or personal information.

The new findings come from a second route. A third-party cloud provider that hosted Fireworks research and development machines had its own security incident on October 23. On October 24 the threat actor used it to reach Fireworks development machines and ran an unauthorised workload there. Fireworks says it detected this the same day, and has seen no further successful access to the platform customers use since October 25.

What was exposed

The internal application the threat actor reached held resource metadata such as identifiers, names and descriptions; billing information including billing and shipping addresses, invoice and payment history, account balance and credit usage; and, for certain customers, a subset of incomplete model weights and datasets. Fireworks does not store payment card numbers. It says it has found no impact on its inference service, Training SDK or Nexus, which keep no data by default.

Fireworks has revoked and replaced credentials and service accounts, cut elevated privileges, isolated affected systems and tightened storage access. It has also disabled self-serve dataset uploads and downloads for batch inference and dataset-based training while the investigation continues, and is notifying affected customers with details and recommended actions.

What is not known

Fireworks has not named the cloud provider, said how many customers were affected, or said whether the two intrusions were carried out by the same group.