Fireworks AI's Second Breach Exposes Model Weights, Billing Data via Cloud Provider
What happened
Fireworks AI disclosed in November 2026 that a third-party cloud provider hosting its research and development systems was compromised on October 23. Attackers reached Fireworks development systems the following day. The incident, reported by The Register, substantially broadens what was disclosed in an earlier October 9 notification. That notification had found no evidence of access to models, datasets, or personal data. The expanded disclosure covers three categories: resource metadata, billing and payment history records, and partial model weights and datasets for certain customers. Fireworks suspects the attack was carried out by criminals engaged in LLMJacking, the practice of stealing access to AI model infrastructure and reselling it through unauthorized channels. Notion confirmed that some AI chat sessions in fewer than one percent of its workspaces may have been exposed. Bloomberg reported Cursor and Harvey are also working with Fireworks to assess impact. This second breach follows the earlier Fireworks AI incident that had been reported to Notion users in October.
Why it matters
- ·The breach originated at a third-party cloud provider, not inside Fireworks itself, meaning enterprise customers had no direct visibility into the exposure point. Vendor risk programs that stop at the primary AI vendor, without covering that vendor's own cloud infrastructure providers, leave this risk unaddressed.
- ·Billing records, invoice histories, and account usage data are now confirmed exposed. Depending on jurisdiction, billing data tied to named individuals or organizations may trigger notification obligations under data protection laws including the General Data Protection Regulation (GDPR).
- ·The exposure of partial model weights, even incomplete ones, signals that proprietary AI assets are becoming targets alongside credentials. Organizations that have deployed custom or fine-tuned models on third-party inference platforms should assess whether their model intellectual property is covered by their vendor contracts and incident response plans.
Stay ahead of stories like this
Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Ask your AI vendor management team to identify every AI inference provider currently used by your organization and whether those providers have disclosed which cloud infrastructure companies host their systems.
- ☐Review your vendor contracts with AI inference platforms to confirm they are required to notify you when their own upstream providers suffer a breach, not only when the vendor's own systems are directly compromised.
- ☐Determine whether any proprietary, fine-tuned, or custom model weights are stored on third-party platforms like Fireworks AI, and assess whether your vendor agreements address who bears liability if those weights are accessed without authorization.
- ☐Check whether the billing and account data exposed in this incident qualifies as personal data under the data protection laws of any jurisdiction where your organization operates, and confirm whether a breach notification obligation has been triggered.
- ☐Review your incident response plan to confirm it covers situations where the breach originates at a sub-vendor, including who is responsible for communicating with affected internal stakeholders when a downstream notification arrives from a SaaS vendor rather than your direct AI provider.
What to watch next
Fireworks AI has not disclosed the total number of affected customers, and investigations with Cursor and Harvey are ongoing. Compliance teams should monitor for further updates on scope, particularly regarding whether inference traffic or additional personal data categories are added to the disclosure. The LLMJacking pattern at the center of this breach reflects a broader trend of AI credential theft. Regulators and financial sector supervisors have been signaling increased attention to AI supply chain security. Enforcement actions tied to inadequate third-party oversight could follow incidents of this scale. Teams should also watch whether Notion's confirmation of exposed AI chat transcripts leads to data protection authority inquiries. This is particularly relevant under the General Data Protection Regulation (GDPR), since chat content could contain identifiable information even without explicit user metadata.