Fireworks AI, the inference provider valued at $17.5 billion in July, says an unauthorized third party reached its development machines on 24 October, 18 days after it identified a first security incident on 6 October. Bloomberg reported on 9 November that Fireworks notified customers that day of a breach in which their data was accessed, its second known hack in a matter of weeks.
In an update to its security bulletin, Fireworks says it has since “discovered impacts to account and billing information” and, for a limited set of accounts, to “secrets, datasets, and incomplete models.” The 18 days are our arithmetic from the dates in its two bulletins.
Business Pill · Usage-Based Pricing
An evergreen Business Engineer explainer on usage-based pricing. It teaches the general idea only and does not discuss Fireworks or these incidents.
The key insight: Fireworks AI says it identified a first security incident on 6 October and that an unauthorized third party reached its development machines on 24 October, through a third-party cloud provider: 18 days apart, by our arithmetic. Its 9 November update says billing information, resource metadata and, for some customers, a subset of incomplete model weights and datasets were in scope.
Update (9 Nov, The Information): Harvey notified, customers weigh a switch.The Information reported on 9 November that Fireworks “in the last week has told some of its large customers including Harvey of a recent, more serious hack to its systems,” according to two people with knowledge of the breach. The hack “exposed data from some Fireworks customers, the company said Monday,” according to the report.
Customers. Some Fireworks customers, “who spend millions of dollars on its services per year, are considering switching to other providers,” one of the people told The Information.
The $1 billion. The Information’s headline calls Fireworks a “$1 Billion Business.” The part of the article we could read does not say what that figure measures. It also carries no response from Harvey and no Fireworks comment beyond the company’s statement that customer data was exposed.
Fireworks, the most highly-valued out of a growing group of inference providers, told customers including Harvey that it had been hit with a hack that exposed customer data. Some customers are now considering moving their business off the platform.
The first incident: on 6 October, Fireworks says, it identified unauthorized use of internal Fireworks credentials. Its first bulletin, published on 9 October, says an unauthorized third party accessed environment variables used in evaluation jobs in a limited number of customer accounts, including API keys and tokens stored as secrets.
The second: Fireworks says a third-party cloud provider that hosted its R&D machines had a security incident on 23 October. On 24 October, the unauthorized third party used it to reach Fireworks development machines and run an unauthorized workload that led to additional customer data impact. Fireworks says it detected this the same day, and that as of 25 October it had not detected further evidence of successful unauthorized access on the platform customers use.
Fireworks says the evidence indicates links to a financially motivated cybercriminal group that aims to sell tokens from unauthorized access to large language models, a practice it calls “LLMJacking”. It does not name the group or the cloud provider.
Days from 6 October 2026, when Fireworks AI says it identified the first incident, to each later event in its two security bulletins. The day counts are our arithmetic from the dates Fireworks states (PDT).
What Was Accessed
The update lists three categories of information that the affected internal application gave access to: resource metadata, such as resource identifiers and display names; billing information, such as billing addresses, invoice and payment history, account balance and credit usage; and, for certain customers, a subset of incomplete model weights and datasets.
Fireworks says payment card numbers are not stored by Fireworks and were not impacted. It says it has not detected any impact to Inference, its Training SDK or Nexus, which are zero data retention by default, and that its investigation is ongoing.
What Customers Were Asked to Do
After the first incident, Fireworks told affected customers to replace revoked Fireworks API keys, rotate third-party credentials named in their notice with the providers that issued them, review activity tied to those credentials, and report any API keys, users, evaluators, training jobs or datasets they did not recognize.
For the second, Fireworks says it is notifying customers whose data was impacted with recommended response actions. It has disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training while it investigates. It says it notified law enforcement and is working with Palo Alto Networks Unit 42 on forensics and hardening.
A Fireworks spokesperson told Bloomberg the company is “actively working with our customers to manage the incident, including Notion, Cursor and others.”
Why It Matters for an Inference Provider
Fireworks runs AI models for other companies; Bloomberg, citing its website, says it has over 10,000 customers. It announced a $1.505 billion Series D in July at a $17.5 billion valuation, with Nvidia among the investors, and we reported its deal for a whole 5 MW Nvidia B300 site in the UK, pitched to banks and other regulated buyers.
On 7 November, two days before the update, Dave Wehner, Meta’s CFO from 2014 to 2022, posted on X about joining Fireworks as CFO. Fireworks was also among at least nine AI developer platforms that disclosed incidents in October, by one count in a wave we covered.
The Structural Read
As we read it, the second incident shifts the question for customers from rotating keys to what data an inference provider keeps at rest: Fireworks points to zero data retention on Inference, the Training SDK and Nexus, while the impact it lists sits in billing, metadata and stored datasets and models.
Fireworks spokesperson, as quoted by Bloomberg on 9 November 2026
“actively working with our customers to manage the incident, including Notion, Cursor and others.”
Three Implications
FOR CUSTOMERS Fireworks says it is notifying customers whose data was impacted with recommended response actions; after the first incident it asked affected customers to replace revoked keys and rotate third-party credentials.
FOR THE PRODUCT Self-serve dataset uploads and downloads used by Batch Inference and dataset-based training are disabled while Fireworks investigates, it says.
FOR FIREWORKS The update came two days after Dave Wehner posted about joining as CFO, and after a July Series D at a $17.5 billion valuation.
The framework argues: “Inference is a revenue engine: continuous, distributed across millions of applications and agents, incurring marginal cost with every query.”
As we read it, a continuous service is also a continuous target: Fireworks says the group behind its incident aims to resell access to language models. The framework predates these incidents and does not discuss Fireworks.
What Is Not Established
Fireworks does not say how many customers were affected by either incident, which cloud provider was involved, or which customers had model weights or datasets accessed. Fireworks presents the 24 October activity as part of its update on the October incident; Bloomberg calls it a second hack. We could read only the opening of Bloomberg’s report.
This Week In The AI Supercycle
The Great Convergence of Capital, Power, and Geopolitics
This week’s issue: for two years the AI build-out was priced as a supply story, and last week as a credit story. This week it was priced as a permission story, and the answer arrived as a cost, not a ban.
Fireworks AI says an unauthorized third party reached its development machines on 24 October, 18 days after it identified a first incident on 6 October, and that the affected internal application gave access to billing information and resource metadata; for some customers, a subset of incomplete model weights and datasets was accessed.
A note on sourcing. Incident dates, data categories, customer actions and remediation steps come from Fireworks AI’s security bulletins of 9 October and 9 November 2026. The spokesperson quote, the customer count and the “second hack” framing come from Bloomberg’s report of 9 November, of which we could read the opening. The 18-day gap is our arithmetic. Fireworks is the target of these incidents; this piece describes no attack technique beyond what the company states.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
