Open-model inference platform Fireworks confirmed on Monday that it has suffered a new intrusion, in which billing information, model weights and datasets belonging to some customers were leaked. According to reports, the company notified several large customers, including Harvey, last week about an incident more serious than the one in October, and it is now investigating with Unit 42, the incident-response team at cybersecurity firm Palo Alto Networks.
A Fireworks spokesperson said the company takes the incident "very seriously" and is working directly with customers while teaming up with Unit 42 to investigate and harden its systems. A spokesperson for legal AI company Harvey said the incident did not affect Harvey's customer data.
Notion, Vercel and Cursor all use Fireworks' services. Whether those companies, or the data of their end users, were affected is still unclear, and none of them has commented publicly.
The second incident in a month
Lay out the timeline and this is the second time in a month that Fireworks has been hit.
On October 6, Fireworks discovered that someone had used the company's internal credentials to read the environment variables of evaluation jobs in a "limited number" of customer accounts, including third-party API keys and tokens stored as secrets. It published a security advisory on the evening of October 9, revoked a batch of user API keys the next day and rotated service-account tokens. The advisory at the time was explicit:
"we have not detected evidence of unauthorized access to customer models, datasets, training data"
A month later, model weights and datasets are on the list of leaked material. Fireworks says it cannot yet determine whether the two incidents are related. Its October advisory page stops at an update dated October 10, with the status listed as "continued monitoring", and as of publication it had not been updated to cover the November incident.
Not the only one caught up
When the October intrusion happened, Fireworks was not alone. In a report published October 30, cloud security firm Wiz called this wave a "Black October" for AI developer platforms: it first listed nine, including Fireworks, Railway, Warp and Lightning AI, and by its November 10 update the number of platforms that had disclosed security incidents had grown to 16, among them NVIDIA's Brev.
The common thread Wiz identified is that attackers specifically hunt for secrets in environment variables, especially those that can call AI services. Once they have a key, they fire off a single request to check that it works, then call the service at scale through proxy pools, and finally monetize it through resale channels. The industry calls this practice of stealing model quota LLM hijacking. In one case Wiz cited, a leaked key was used about 800,000 times in roughly 30 hours; in another, 1.7 million calls were made in about 13 hours, and at list prices the two cases together could exceed $100,000.
According to reports, Unit 42 believes the attack on Fireworks is linked to a cybercrime group that engages in LLM hijacking. That claim so far appears only in secondhand media accounts; Unit 42 has not published a public report and has not named the group.
A funding window meets a security incident
The timing is awkward for Fireworks. The company, founded in 2022, reached an annualized revenue of $1 billion in July this year and a valuation of $17.5 billion; people familiar with the matter said it had planned to start a new funding round this week, targeting a valuation of at least $30 billion.
Also according to people familiar with the matter, some large customers that spend several million dollars a year on the platform are weighing a move elsewhere. Fireworks did not respond on whether the funding round will be delayed or how many customers will actually migrate, and that part cannot currently be verified.
For users, the advice in Fireworks' October advisory still applies: deleting a stored key inside Fireworks does not invalidate the key itself. Rotate third-party credentials with the relevant provider, then review the access logs for those credentials.
Sources: Sina Finance, Fireworks security advisory, CocoLoop, Wiz security research report. Verified items: the scope of data exposed in both incidents, the number of affected platforms and the number of key-abuse calls; revenue and valuation figures follow the reported numbers.