Fireworks AI discloses new breach after cloud provider hack

A credential leak at Fireworks is now a trust-relationship problem between its systems and connected services, not just a contained internal issue.

AI infrastructure startup Fireworks has disclosed a new security breach in which attackers accessed its development machines after breaching a third-party cloud provider.

FireWorks provides a high-performance inference platform for developers who want to deploy and run open-source artificial intelligence models (such as Mistral, Meta's Llama, or Google's Gemma) without worrying about hardware bottlenecks and complex infrastructure tasks.

After revoking compromised internal credentials, affected Fireworks API keys, and keys created by the attackers, Fireworks discovered another security incident on October 23.

In the new breach, the threat actors accessed resource metadata (e.g., Fireworks resource identifiers, display names, descriptions, creation time), billing information (e.g., billing and shipping addresses, invoice and payment history, account balance, and credit usage), and incomplete model weights and datasets for some customers.

One week ago, researchers at Google's Threat Intelligence Group (GTIG) and Mandiant reported that large language model hijacking attacks (also known as LLMjacking) are driving record costs for compromised organizations, with cloud AI charges reaching as high as $1 million due to fraudulent calls using stolen API keys.

Anyone connected to Fireworks through the compromised trust relationship is potentially affected, not just Fireworks itself.

The company notified law enforcement and customers of another security incident in early October after attackers accessed environment variables containing API keys and tokens stored as secrets for a limited number of accounts.

However, the company said the attackers couldn't access customer payment card numbers because Fireworks doesn't store them.

There's no patch for a leaked credential the way there is for a code flaw; the only fix is making sure it's actually dead, not just flagged as risky.

On October 24, the unauthorized third party used it to reach Fireworks development machines and then run an unauthorized workload that led to more customer data impact, Fireworks noted in a Monday advisory.

As of October 25, we have not detected further evidence of successful unauthorized access by the threat actor on the Fireworks platform customers use.

The trust mechanism involved here is an API or master key, which is what let access move between otherwise unrelated systems.

We detected this activity on the same day, and followed our incident response processes to take immediate remediation measures and close known critical vulnerabilities.

Since the attack, Fireworks revoked and replaced credentials and service accounts, restricted unauthorized network pathways, isolated affected systems, and tightened access to data storage and analytics systems to block public or unauthorized access to stored data.

Fireworks says the credential has been revoked, and no exploitation has been confirmed so far.

The company is now working with Palo Alto Networks' Unit 42 incident response division to secure its systems against future attacks and further investigate the incident's full scope and impact.

If you have any integration or dependency involving Fireworks, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.

Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.