AI infrastructure startup Fireworks has disclosed a new security breach in which attackers gained access to its development machines after compromising a third-party cloud provider. Fireworks offers a high-performance inference platform that lets developers deploy and run open-source AI models, such as Mistral, Meta’s Llama, and Google’s Gemma, without managing the underlying hardware and infrastructure.

This is not the company’s first incident in recent weeks. In early October, Fireworks notified law enforcement and customers that attackers had accessed environment variables containing API keys and tokens stored as secrets for a limited number of accounts. At the time, the company said the evidence pointed to a financially motivated threat actor group seeking to resell unauthorized access to large language models through illicit routing gateways, a practice known as LLMjacking. After revoking compromised credentials and affected API keys, Fireworks identified a second incident on October 23.

What the attackers accessed

According to the company, the threat actors obtained the following categories of data:

  • Resource metadata, including Fireworks resource identifiers, display names, descriptions, and creation times
  • Billing information, including billing and shipping addresses, invoice and payment history, account balances, and credit usage
  • Incomplete model weights and datasets for some customers

Fireworks stated that attackers could not access customer payment card numbers because the company does not store them.

How the breach unfolded

In a advisory published on Monday, Fireworks said a third-party cloud provider hosting its research and development machines experienced a security incident on October 23. The next day, an unauthorized party used that access to reach Fireworks development systems and run an unauthorized workload that led to additional customer data exposure. The company said it detected the activity the same day and moved to contain it. As of October 25, Fireworks reported no further evidence of successful unauthorized access to the platform that customers use.

Remediation steps

Fireworks says it has revoked and replaced credentials and service accounts, restricted unauthorized network paths, isolated affected systems, and tightened access controls on data storage and analytics systems to block public or unauthorized access. The company is working with Palo Alto Networks’ Unit 42 incident response team to harden its environment and determine the full scope and impact of the incident.

Broader context

The disclosure comes shortly after researchers at Google’s Threat Intelligence Group and Mandiant reported that LLMjacking attacks are driving sharply higher costs for compromised organizations, with cloud AI charges in some cases reaching as high as $1 million from fraudulent calls made with stolen API keys. For security teams, the Fireworks case underscores two lessons: the security posture of upstream cloud and development providers can directly affect downstream customers, and API keys and tokens stored as secrets remain a high-value target.

Organizations using hosted AI inference services should review which credentials and keys they have issued, rotate any that may have been exposed, and monitor for unexpected usage and billing anomalies.