Fireworks AI CEO Confirms Breach, Revoked Credentials, Ongoing Investigation

Fireworks AI CEO Lin Qiao publicly confirmed a security incident involving unauthorized use of internal credentials, stating the company contained it, revoked the compromised credentials, and notified affected customers directly, with an investigation ongoing alongside a cybersecurity firm. The breach, which The Information reported occurred on October 24, entered through a third-party cloud provider hosting Fireworks research systems and reached customer billing records; for some accounts, datasets and incomplete model weights were also accessed. Attackers accessed billing data but not full card numbers, according to Fireworks AI's own account. Fireworks tied the attack to an LLMjacking group that resells stolen AI account access. Affected customers include legal AI firm Harvey, and some customers are considering moving their business off the platform.