Fireworks AI Reports Second Breach via Compromised Cloud Provider

Fireworks AI disclosed two separate security incidents within weeks. The first in early October involved stolen API keys and tokens from some accounts, which criminals repurposed for LLMjacking—unauthorized resale of stolen API access to illicit routing networks. A second incident followed after a third-party cloud provider hosting Fireworks’ research machines was breached; attackers used this foothold to penetrate Fireworks’ development systems on October 24, with the company detecting the intrusion the same day.

In the second breach, attackers accessed customer metadata, billing information, partial model weights, and training datasets. Payment card data remained unexposed because Fireworks doesn’t store this information. The company responded by revoking all compromised credentials, isolating affected systems, restricting network access, and engaging Palo Alto Networks’ incident response team for forensic analysis and system hardening.

The incidents highlight vulnerabilities in cloud infrastructure supply chains. LLMjacking has emerged as a significant attack vector, with researchers documenting fraudulent API charges exceeding $1 million for compromised organizations as attackers exploit stolen credentials to run unauthorized model inference workloads.