The Fireworks breach reached the assets AI infrastructure vendors are hired to protect

Fireworks AI has disclosed two October intrusions with a wider impact than it initially knew. In the first, discovered on October 6, an attacker used internal Fireworks credentials to reach environment variables used by customer evaluation jobs. Fireworks originally said it had found no evidence that customer models or datasets were accessed; its November update says the investigation later found affected account and billing information and, for a limited set of customers, secrets, datasets and incomplete model weights.

A separate compromise began at a third-party cloud provider hosting Fireworks research-and-development machines. On October 24, the attacker used that access to reach Fireworks development systems, execute an unauthorized workload and cause additional customer-data exposure. Fireworks says it detected the activity that day and has seen no further successful access since October 25. It has disabled self-service dataset uploads and downloads for batch inference and dataset-based training while Unit 42 investigates.

The downstream impact is visible at Notion. Fewer than 1% of its workspaces were affected, but the exposed material included Notion AI chat transcripts used by an Insights feature. Most could not be linked to a user or company because identifiers and tool results were absent, yet the text itself could contain passwords, API keys or confidential material. Notion disconnected from Fireworks, deleted its stored data, disabled Insights and stopped serving open-weight models through the provider.

This clarifies a common ambiguity in AI infrastructure. Fireworks says its main inference service, Training SDK and Nexus use zero data retention by default and were not affected. That did not protect data placed in evaluation jobs, analytics, batch workflows or R&D systems. A customer can therefore believe it selected a zero-retention inference path while adjacent product features create stored copies with different security properties.

The commercial consequences extend beyond incident response. Fireworks had reached roughly $1 billion in annualized revenue and was preparing a financing that could value it above $30 billion. The Information reports that some major customers are considering alternatives. For an inference provider, model weights, datasets and prompts are not incidental records; they are the customer’s intellectual property. The breach tests whether a rapidly scaled platform can prove service-by-service data boundaries before customers decide that cheaper open-model inference is not worth the concentration risk.