Fireworks AI told customers on November 9, 2026, that the October intrusion into its systems reached further than it first disclosed. Billing records and account data were accessed, and for a limited set of customers, so were secrets, datasets, and incomplete model weights. The same day, Notion disclosed that the breach touched its product: fewer than 1 percent of Notion workspaces were affected, and the data involved was Notion AI chat transcripts used for the Insights feature.
This is Fireworks' second disclosure in five weeks, and the two incidents have different entry points. The first, found on October 6, was unauthorized use of internal credentials. The second came through a third-party cloud provider that hosted Fireworks' research and development machines. The widening matters because the first bulletin said no customer models, datasets, or training data had been touched. Five weeks later, that is no longer the case.
Two intrusions, not one
| Date | What happened |
| October 6, 2026 | Fireworks identifies unauthorized use of internal credentials and begins containment |
| October 9, 2026 | First bulletin: only Fireworks stored secrets used in evaluation jobs were known to be accessed |
| October 23, 2026 | A third-party cloud provider hosting Fireworks research machines has its own security incident |
| October 24, 2026 | The intruder uses that foothold to reach Fireworks development machines and run an unauthorized workload; Fireworks detects it the same day |
| October 25, 2026 | Fireworks says it has detected no further successful access on the customer-facing platform to date |
| November 2, 2026 | Fireworks tells Notion a small dataset was accessed; Notion finds it was synthetic testing data, with no customer data involved |
| November 3, 2026 | By the morning, Notion has disconnected from Fireworks, deleted all data in the Fireworks system, and stopped all communication |
| November 6, 2026 | Fireworks tells Notion that malicious actors may have accessed potential customer data |
| November 8, 2026 | Fireworks confirms the new dataset to Notion |
| November 9, 2026 | Fireworks publishes its updated bulletin; Bloomberg reports the second disclosure |
The sequence is the story. Notion acted on the first notice within hours, disconnecting and deleting its data on November 3, before it knew customer data was involved. The second notice arrived three days later, and it changed the picture: the new dataset was real customer content, not test data.
What was actually taken
| Category | What Fireworks says was accessed | Scope |
| Resource metadata | Resource identifiers, display names, descriptions, creation times | Affected accounts |
| Billing information | Billing and shipping addresses, invoice and payment history, account balances, credit usage | Affected accounts; payment card numbers are not stored by Fireworks and were not impacted |
| Secrets | Stored secrets, including those used in evaluation jobs | A limited set of accounts |
| Datasets | A subset of datasets | A limited set of accounts |
| Model weights | A subset of incomplete model weights | A limited set of accounts |
| Not affected | Inference, Training SDK, and Nexus, which are zero data retention by default | No impact detected so far |
Fireworks has not published a count of affected customers, and no outlet has confirmed one, so there is no number to report. What is confirmed is the shape of the loss: the billing data covers the whole affected account base, while the secrets, datasets, and weights are limited to a smaller set. The weights were incomplete, which matters: a partial set of weights is not a working copy of a model, but it is still proprietary training output that was never meant to leave the company.
What Notion did, and what its users should do
Notion's response was fast and public. Within a day of the first notice it had cut Fireworks off entirely, and it published a security advisory naming the vendor, the dates, and the data. The advisory says the Insights feature, which used Fireworks for classification jobs that helped customers understand their own AI usage, has been disabled while the investigation continues, and that Notion is no longer serving open-weight models through Fireworks. No other Notion features were affected.
For the workspaces that were hit, Notion says the transcripts were, for the vast majority, unattributable: the chats were not labeled with who wrote them, or which workspace they came from, and they did not contain tool call results. Beyond what is in the transcript itself, there is nothing tying a chat back to a workspace, a user, or a company. That limits the damage, but it does not erase it: a transcript is still the words a person typed. Notion's advice to affected customers is to treat the data as if it were exposed, and to rotate any passwords, API keys, or other credentials pasted into Notion AI during the incident. Affected customers can retrieve and review the impacted data inside their workspace, with instructions sent by email. Notion says it contacted the customers who were identified as affected.
Bloomberg reported on November 9 that a Fireworks spokesperson said the company is actively working with customers to manage the incident, including Notion and Cursor. Fireworks says it is notifying affected customers directly with account-specific details and recommended actions.
The motive has a name: LLMJacking
Fireworks links the activity to a financially motivated cybercriminal group that sells tokens from unauthorized access to large language models through illicit routing gateways, a scheme known as LLMJacking. Google's Threat Intelligence Group and Mandiant published a blog post on November 2 about the rise of LLMJacking, its motives, its techniques, and how to mitigate it, and Fireworks points to that research in its bulletin. The motive fits the intrusion: the attackers ran an unauthorized workload on Fireworks' development machines, which is what you do when you want compute, not when you want to deface a website.
Fireworks says it notified law enforcement and brought in Palo Alto Networks Unit 42 for forensic analysis. Its hardening measures include revoking and replacing credentials and service accounts, removing unnecessary elevated privileges, restricting network pathways and isolating affected systems, tightening access to data storage and analytics, and securing its logging and monitoring. Self-serve dataset uploads and downloads used by Batch Inference and dataset-based training are disabled while the investigation continues. The bulletin stresses that its findings are based on the investigation to date, and that the investigation is ongoing and may reveal more.
Why inference vendors are the soft target
An inference provider is a concentrated target by design. Thousands of customers send it the same three things an attacker wants: API keys, datasets, and model weights. Notion describes Fireworks as one of the most used global AI infrastructure platforms, powering tens of thousands of customers and used by hundreds of thousands of developers. When a vendor that size is breached, the blast radius is every customer that trusted it with data, and the vendor's own disclosure is the only map of who was hit.
The second intrusion adds a harder lesson: the entry point was not Fireworks itself, but a third-party cloud provider hosting its research machines. Your vendor's vendor is your exposure, and no amount of diligence on the vendor's own perimeter covers a foothold in someone else's cloud. The one design choice that held up in this incident is the one Fireworks points to itself: Inference, Training SDK, and Nexus are zero data retention by default, and Fireworks says it has found no impact on them. Data that is never stored cannot be stolen, which is a stronger guarantee than any promise to guard stored data well. We catalogued the 2026 pattern of AI security failures in October, and the lesson from that report card was the same: assume the vendor is breached, and design so the breach finds nothing worth taking.
The boundary question is not only about breaches. This is the second time in two days a major AI product has had to explain where user content goes outside its own walls: Google said on November 9 that Gemini can route Drive files and emails to human reviewers. One story is a crime, the other is a policy, but both ask the same question of the user: do you know where your data goes once you type into an AI product.
Sources: Fireworks AI, October 2026 Security Incident Update (November 9, 2026); Notion, Security Incident Involving a Third-Party AI Vendor (November 9, 2026); Bloomberg, Fireworks AI Discloses Second Data Breach in Weeks (November 9, 2026); Google Threat Intelligence Group and Mandiant, LLMJacking: The Rise of Illicit AI Compute (November 2, 2026). By ByteHerald Staff. For corrections, contact the ByteHerald newsroom.
Comments
Post a Comment