Fireworks AI hit twice in October; only Notion confirms user notice

The two Fireworks intrusions followed different paths, which helps explain why the scope is hard to pin down. The Oct 6 breach involved internal credentials used without authorization to read environment variables in a limited number of customer accounts during evaluation jobs for reinforcement fine-tuning; those variables held API keys and tokens customers had deposited for other services. Fireworks had already stopped accepting new managed RFT jobs on Oct 1, before detecting the intrusion on Oct 6, and by Nov 10 its docs said the evaluator and evaluation jobs had also been deleted — though the docs do not say when.

The Oct 23–24 intrusion came through a third-party cloud hosting R&D machines, from which attackers reached development machines. According to the CEO's post, they escalated privileges in stages, impersonated one service account, and reached part of storage containing billing information, some customer datasets, and unfinished model weights. The follow-up ties the actor to LLMJacking, a financially motivated group that resells stolen LLM usage quotas, with bills going to the key owner. That shift is also visible in the wording: the Oct 10 notice said no unauthorized access to customer datasets had been found, while the Nov 9 update said some datasets had been accessed.

The Notion case shows why the distinction between inference and stored jobs matters. Inference responds and ends, which ZDR covers, but classification jobs place records on Fireworks' side, and the second intrusion reached that storage. Notion says Fireworks had contractually promised ZDR for this analysis, yet data remained, and no public Fireworks response to that point had been found as of Nov 14. The episode echoes earlier supply-chain breaches such as CircleCI (disclosed January 2023) and Codecov (2021), where a party holding many customer keys was compromised and customers were told to reissue them all — damage that spreads beyond the key holder's visibility.