Summary
- Fireworks AI's 9 November update identifies account information, billing records, secrets and some customer datasets and incomplete models among affected material.
- A separate third-party cloud incident enabled access to Fireworks development systems on 24 October.
- Notion says fewer than 1% of workspaces were affected, including some AI Insights chat transcripts processed through Fireworks.
AI infrastructure provider Fireworks AI has expanded its assessment of an earlier security incident to include customer account information, billing records and, for a limited number of customers, datasets and incomplete model weights.
The findings were published in a security update on 9 November, following an investigation supported by Palo Alto Networks Unit 42. Fireworks says the incident affected internal systems and involved additional unauthorised activity through a third-party cloud provider used for research and development infrastructure.
The company has identified evidence linking the activity to financially motivated cybercriminals involved in obtaining access to large language model services and reselling that access through unauthorised gateways, a practice commonly described as LLMJacking.
That connection remains Fireworks’ investigative assessment. The company has not publicly established that all affected data was sold, nor has it identified every account or downstream organisation involved.
Its revised disclosure extends the potential consequences beyond the secrets initially known to have been accessed when the incident was first reported in October.
Investigators identify wider customer data access
Fireworks says the affected internal application provided access to resource metadata, including identifiers, descriptions and other information used to manage customer resources.
Account and billing information was also affected, including billing addresses, invoices, payment history, balances and credit usage. The company says it does not store customer payment card numbers and that those numbers were not compromised.
For a limited group of accounts, the investigation identified access to additional secrets, datasets and portions of model weights.
Model weights are numerical parameters used by machine learning systems to produce their outputs. They can represent valuable intellectual property where they originate from proprietary development or fine-tuning work.
However, Fireworks describes the accessed model material as incomplete. Its disclosure does not establish that attackers obtained full, usable copies of every affected model or that they were able to reconstruct proprietary systems from the available fragments.
The precise consequences will depend on the content and completeness of the material accessed for each customer.
Third-party incident extended the intrusion
Fireworks says a cloud provider hosting some of its research and development machines experienced a security incident on 23 October.
On 24 October, the unauthorised party used that access to reach Fireworks development machines and run an unauthorised workload, creating additional customer data exposure.
The company detected the activity on the same day and implemented containment measures, including restricting access and addressing known critical vulnerabilities.
Fireworks says it has found no further evidence of successful unauthorised access to its customer platform since 25 October.
Its investigation has nevertheless identified material that was not recognised as affected in the initial assessment, demonstrating how the understood scope of an incident can change after access has been contained.
Fireworks says its Inference, Training SDK and Nexus services have not been identified as affected. Those services operate with zero data retention by default, according to the company’s description.
That assurance concerns the specified services and the evidence available so far. It does not cancel the confirmed exposure associated with other Fireworks systems or the information subsequently identified by downstream customers.
Notion identifies limited downstream exposure
Notion has separately confirmed that a subset of its workspaces may have been affected through its use of Fireworks AI.
According to Notion’s 9 November update, Fireworks notified the company on 2 November that a small dataset had been accessed. Initial analysis identified synthetic testing information rather than Notion customer data.
Notion disconnected its systems from Fireworks by the following morning and removed data held within the provider’s environment.
On 6 November, Fireworks alerted Notion to possible additional customer exposure, which was confirmed on 8 November. Notion subsequently identified AI chat transcripts associated with its Insights feature among the affected material.
Notion says fewer than 1% of workspaces were affected. For most of those workspaces, the transcripts lacked identifiers directly connecting the content to a particular user or organisation, although the information written inside a conversation could still itself be sensitive.
The company has contacted affected customers and provided a way to review the relevant material. It has disabled Insights while investigating and stopped using Fireworks to serve open-weight models in its product.
No other Notion features were identified as affected in the company’s disclosure. Notion also emphasises that its own systems were not the source of the breach.
AI service dependencies complicate accountability
AI-enabled applications frequently rely on external providers for inference, classification, training support and other processing tasks. These relationships can involve customer prompts, model artefacts or associated account information, depending on the functions being supplied.
An incident at an infrastructure provider can therefore require several organisations to determine which data was processed, what was retained and which customers need to be notified.
Notion’s response illustrates that the assessment may change as forensic findings develop. An initial determination that only synthetic data was exposed was followed by confirmation that some customer chat transcripts were included.
Fireworks has revoked and replaced credentials, tightened privileges, restricted network paths and strengthened monitoring. It has also temporarily disabled self-service dataset uploads and downloads for certain services while its investigation continues.
The company is notifying affected customers individually and continues working with Unit 42. Neither Fireworks nor Notion has stated that every user of the affected services experienced data exposure.
The outstanding questions concern the complete scope of information obtained, the relationship between the different phases of unauthorised activity and whether further customer-specific findings emerge from the continuing investigation.
