Hackers reached customer data and unfinished AI models at Fireworks, a $17.5 billion AI host

Fireworks AI, which runs and customizes AI models for about 10,000 business customers, has admitted that a security incident it first described in October went further than it said at the time. In an update dated November 9, the company said attackers reached customer billing records and, for a limited set of accounts, customer datasets and partly finished AI models.

The disclosure matters beyond one vendor. Fireworks is among the most valuable companies in AI hosting. Forbes puts its valuation at $17.5 billion, up roughly fourfold in nine months, and lists Uber, Shopify, DoorDash, Upwork, Cursor and Cognition among its customers. Companies hand firms like it their own data and their custom-built models. A breach at that layer is a risk most buyers have not priced in.

The fallout is already commercial. Two customers told Forbes they had moved a large share of their business off Fireworks. One described a string of increasingly frequent hacks and criticized how the company communicated. Two other customers Forbes reached said they had not heard of any breach.

What Fireworks now says happened

The story has two parts. On October 6, Fireworks detected someone misusing its internal credentials. At first it said attackers had captured access keys and other secrets that a limited number of customers had stored for testing jobs. It said then that it had found no sign that customer models, datasets or personal information were touched.

The second part came later. On October 23, an outside cloud provider that hosted Fireworks' research machines suffered its own security incident. The next day, the intruder used that opening to reach Fireworks' development systems and run unauthorized software. Fireworks says it caught this the same day and has seen no further break-ins to its customer platform since October 25. It has not named the cloud provider.

The updated list of exposed data is longer than the first. It includes account details such as resource names and descriptions, and billing records covering addresses, invoices, payment history, balances and credit usage. For certain customers it also includes datasets and a subset of incomplete model weights, the learned settings that make up a trained model. Fireworks says it does not store card numbers, so those were not affected.

Fireworks says its main products for running and training models showed no impact, because by default they do not keep customer data. It has brought in Palo Alto Networks' Unit 42 for forensic work and told law enforcement. It also switched off self-service uploads and downloads of datasets for some services, and says its findings could still change as the investigation continues.

A crime built around stolen AI access

Fireworks says its evidence points to a financially motivated criminal group that sells stolen AI access. The practice is known as LLMjacking, after the large language models (LLMs) behind chatbots: thieves take a company's keys to AI services, use or resell that access, and leave the victim with the bill. Fireworks has not named the group or disclosed any financial loss.

The attribution lines up with a warning Google published on November 2. Google's threat intelligence unit and its Mandiant incident-response arm described a growing underground market for stolen AI access. In some cases they handled, fraudulent charges topped $100,000 in a single day. At some organizations, total charges reached $1 million before the access was cut off.

Google describes a new kind of middleman it calls LLM mixers. These are illicit gateways that pool stolen keys and resell AI access to other criminals. One advertised unlimited use, with claimed access to top-tier models, for about $60 a month. Google believes the service relies on stolen keys to make money. Google said the groups it tracked were profit-driven and spread across several regions.

There may also be an AI angle to the attack itself. Forbes reported that Fireworks CEO Lin Qiao wrote on X that the attackers' behavior suggested AI agents were involved in the earlier hack. Fireworks' own updated bulletin does not repeat that claim, and no outside investigator has confirmed it.

What buyers should take from it

The weak point here was not the AI model. It was ordinary security: stored keys, an outside cloud supplier and the path between them. That matches Google's findings: in the cases it investigated, the most common way in was exposed or stolen cloud login credentials, not exotic attacks on AI.

For companies buying AI services, three questions follow. First, which outside suppliers can reach the systems that hold your data and models? Fireworks' second intrusion came through an outside cloud provider it still has not named. Second, what does the vendor keep? Fireworks' products that keep no customer data by default were, by its account, untouched. Third, how fast will you hear? The second intrusion happened on October 24, but the wider scope was disclosed on November 9.

Google's advice is plain: keep access keys short-lived and narrowly scoped, cap spending per model, and treat any unauthorized switch-on of an AI service as a critical security event. Those controls cost little next to a six-figure daily bill or a leaked dataset.

For Fireworks, the test is trust. Its growth has rested on persuading companies to let it host and tune their models instead of building that capability themselves. A breach that touched customer datasets and model work goes to the heart of that pitch. How many accounts were affected, what the outside cloud provider was, and whether the group behind it is still active remain open questions.