🔍 Read the full analysis: Are Your AI Datasets In Scope Of The Fireworks AI Breach? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Fireworks AI’s November 9 update says an October security incident reached account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models. Notion says transcripts from its AI Insights feature may have been in a dataset that attackers could access; it says fewer than 1% of workspaces were affected. The number of affected Fireworks customers, the cloud provider involved and the fate of accessed data remain unknown.
Fireworks AI said November 9 that an October security incident affected account and billing information and, for a limited set of accounts, secrets, datasets and incomplete models—a broader impact than the company described in its first bulletin. Notion separately said transcripts from its AI Insights feature may have been in a dataset attackers could access, with fewer than 1% of workspaces affected, according to Notion.
Fireworks, a platform companies use to run and fine-tune AI models, described two access routes. In the first, discovered October 6, someone used internal Fireworks credentials to read environment variables from customer evaluation jobs. Those variables can contain credentials such as API keys. The company said it began containment that day and started notifying affected customers on October 7.
Fireworks later reported a separate incident involving a third-party cloud provider hosting its research and development machines. The provider experienced a security incident on October 23, and on October 24 an unauthorized party used that route to reach Fireworks development machines and run an unauthorized workload, according to the company. Fireworks said it detected the activity on October 24. It has not named the provider.
The company lists exposed categories as resource metadata; billing and account information, including addresses, invoice and payment history, account balances and credit usage; and, for certain customers, a subset of datasets and incomplete model weights. Fireworks said it has not detected further successful unauthorized access through the platform since October 25. It also said it had not detected an impact to its Inference, Training SDK and Nexus products, which it described as zero-data-retention by default.
Are Your AI Datasets In Scope?
Fireworks AI’s November 9 update expanded the reported impact of an October security incident. Some accounts may involve secrets, datasets and incomplete models.
What may be affected
Fireworks says the scope varies by account; the affected customer total has not been disclosed.
Billing and resource details
Reported categories include account information, billing history, balances, credit usage and resource metadata.
Secrets and AI assets
A limited set of accounts may involve secrets, datasets and incomplete model weights.
AI Insights transcripts
Notion said transcripts may have been in an accessible dataset; this does not establish they were viewed or taken.
Two reported access routes
The investigation identified internal credentials and a separate cloud provider incident.
Internal credentials were used to read environment variables from customer evaluation jobs. Fireworks began containment October 6.
After a cloud provider incident on October 23, an unauthorized party accessed Fireworks development machines on October 24.
What remains unknown
The public updates do not establish the full customer impact or what happened to accessed data.
- How many customers or accounts were affected
- Which cloud provider was involved
- Whether data was copied, retained, shared or used
- How incomplete the model weights were
- Whether Notion transcripts were actually accessed
Risks for Customer Data and Models
The update matters because organizations may use Fireworks to process proprietary datasets and adapt models for their own products. Access to a dataset or model weights could expose business information or work in progress, while account and billing details can create separate risks for customers. Fireworks says the model weights involved were incomplete; it has not explained how incomplete they were or what practical use they might have.
Notion’s disclosure shows that the potential reach may extend to information handled by a Fireworks customer, not only data a company directly uploads under its own name. Notion said the relevant dataset contained chat transcripts from its AI Insights feature and that fewer than 1% of workspaces were affected. The disclosure does not establish that every transcript in those workspaces was accessed or that the data was taken or misused.
For customers, the incident also highlights the importance of knowing which vendors and service providers can handle datasets, model artifacts and credentials. Fireworks’ update gives affected users new categories to check, but the company has not published a total number of impacted customers.
Products Worth Considering
Samsung Galaxy Tab S7 11-inch Android Tablet 128GB Wi‑Fi with S Pen Mystic Black
Apple AirPods Pro (2nd Generation) Wireless Earbuds with USB‑C Charging, Up to 2X More Active Noise Cancelling, Transparency Mode, Adaptive
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
As an affiliate, we earn on qualifying purchases.
From October Bulletin to Broader Update
Fireworks’ first public bulletin, dated October 9, described misuse of internal credentials and access to environment variables in a limited number of customer accounts. At that point, the company said it had not detected evidence of unauthorized access to customer models, datasets, training data, inference traffic, prompts, outputs or personal information. Its November 9 update said the investigation later identified impact to account and billing information and, for some accounts, secrets, datasets and incomplete models.
The company’s timeline places its first detection on October 6, its initial customer notifications on October 7 and key rotations on October 9 and October 10. The second route involved the cloud provider incident on October 23 and activity on Fireworks development machines the next day. Fireworks said it notified law enforcement and brought in Palo Alto Networks Unit 42 to assist with forensic work.
Notion said Fireworks first contacted it on November 2 about a dataset it initially understood to be synthetic test data. On November 6, Fireworks told Notion that malicious actors may have accessed potential customer data, and the dataset was confirmed on November 8, according to Notion’s advisory. Fireworks published its expanded account the following day.
“For a limited set of accounts, we also discovered impact to secrets, datasets, and incomplete models.”
— Fireworks AI, November 9 security update
What the Investigation Has Not Established
Fireworks has not said how many customers or accounts were affected, which cloud provider was involved, or how the internal credentials were first obtained. It also has not explained what “incomplete” means for the accessed model weights, how many datasets were involved, or whether the data was copied, retained, shared or used. Access does not by itself establish that information was exfiltrated or misused.
The company said evidence indicates links to a cybercriminal group, but the supplied update does not identify that group or provide enough detail to independently assess the attribution. Fireworks said its investigation is ongoing and may reveal additional information. Its statement that it detected no further successful access after October 25 is limited to what it has identified so far; it is not a finding that all possible consequences are known.
Notion’s workspace figure is company-reported, and the available information does not specify how many individual transcripts were in the dataset or whether attackers actually viewed or obtained them. Fireworks also has not reported customer-by-customer exposure details publicly in the material available here.
Customer Notices and Service Restrictions
Fireworks says it is continuing its investigation with help from Unit 42 and law enforcement. It has disabled self-service dataset uploads and downloads used by Batch Inference and dataset-based training as a precaution while the review proceeds. The company has not provided a date for restoring those functions or a timetable for a final report.
Customers using Fireworks can expect the company’s investigation and any direct notices to clarify whether their accounts, datasets, credentials or model artifacts were involved. Organizations should rely on vendor communications for account-specific confirmation rather than assume that a broadly described affected category applies to every customer. Further information is also needed on the third-party provider incident and the handling of any data attackers may have accessed.
Key Questions
What information does Fireworks say may have been affected?
Fireworks lists resource metadata, account and billing details, and, for a limited set of accounts, secrets, datasets and incomplete model weights. It says payment card numbers were not affected because it does not store them.
Were all Fireworks customers affected?
No such conclusion has been reported. Fireworks has not disclosed the total number of affected customers and describes the impact to secrets, datasets and incomplete models as applying to a limited set of accounts.
What does Notion say about its AI Insights transcripts?
Notion said transcripts from its AI Insights feature were in a dataset that attackers may have accessed. It reported that fewer than 1% of workspaces were affected, but the available information does not say how many transcripts were involved or confirm that they were taken or misused.
Did Fireworks say its inference products were affected?
Fireworks said it had not detected an impact to Inference, Training SDK and Nexus, which it describes as zero-data-retention by default. That statement reflects the company’s findings reported in its update; its investigation is ongoing.
What remains unknown about the incident?
The provider’s identity, the number of affected customers, how the internal credentials were obtained, and what happened to accessed data have not been disclosed. Fireworks also has not defined what it means by incomplete model weights.
Source: ThorstenMeyerAI.com
