Fireworks AI revealed Monday that a security breach first detected last month reached further than initially disclosed, compromising account and billing details, secrets, datasets, and partial models for a "limited set of accounts." The AI infrastructure company published an update to its October 10 notice, explaining that attackers accessed its development environment through an unidentified third-party cloud provider on October 23, 2026. The expanded breach affects both customer data and internal systems, though payment card numbers weren't stored by the company and remained unaffected.

The initial incident was spotted on October 6, 2026, at 9 a.m. PDT, when Fireworks detected unauthorized use of internal credentials that let an unknown third party access environment variables in evaluation jobs for certain customer accounts. At that point, the company believed only environment variables—including API keys and tokens saved as secrets—were captured in some affected accounts, with no indication that customer models, datasets, training data, inference traffic, or personal information had been touched. But on October 24, the unauthorized party used the compromised access to reach Fireworks development machines and execute an unauthorized workload that led to additional customer data exposure. The breach granted access to resource metadata such as Fireworks resource identifiers, display names, descriptions, and creation timestamps; billing information including billing and shipping addresses, invoice and payment history, account balance, and credit usage; and a subset of incomplete model weights and datasets for certain customers. As of October 25, Fireworks reported no further evidence of successful unauthorized access by the threat actor on the platform customers use.

The company said it's alerting customers whose data was impacted and has rolled out security hardening procedures, including credential revocation and rotation, isolating affected systems to block further unauthorized activity and lateral movement, tightening access controls, and improving logging and monitoring systems. According to Fireworks AI, "the evidence indicates links to a cybercriminal threat actor group, which is financially motivated and aimed at selling tokens from unauthorized access to large language models (LLMs) to illicit routing gateways." The incident also touched Notion, with the productivity and note-taking application disclosing that the Fireworks AI breach impacted "fewer than 1% of Notion workspaces." Notion initially thought the breach only affected its AI synthetic testing data, but later analysis revealed it also involved potential customer data, specifically Notion AI chat transcripts used for the Insights feature, which for most impacted workspaces were unattributable—meaning the chats weren't labeled with who wrote them or which workspace they came from, and transcripts didn't contain tool call results.

The activity is part of an emerging threat known as LLMjacking, which involves hijacking a victim's large language model through stolen credentials to power a criminal operation that sells the access to other threat actors while sticking the legitimate owner with the bill. Last week, Google issued a warning that threat actors are increasingly targeting AI infrastructure for LLMjacking in North America, South America, and Asia Pacific across the financial services, retail, technology, and transportation sectors. Notion has disabled the Insights feature as it continues investigating the breach and is no longer serving open-weight models through Fireworks. Affected customers are advised to review the impacted data securely inside their workspace, and if those with affected workspaces pasted sensitive information, passwords, API keys, or other credentials during the attack window, it's recommended to rotate them immediately. The provider landscape for generative AI remains fragmented, creating multiple points of vulnerability that organizations must now account for when evaluating their exposure. Companies relying on third-party AI infrastructure may need to reassess their vendor risk frameworks as attackers demonstrate growing sophistication in monetizing stolen access.