Fireworks AI breach widens — Notion AI chats exposed in under 1% of workspaces

A month after saying it had found no evidence of access to customer models or datasets, Fireworks AI revised that account. On November 9, 2026 (US time), the AI inference platform published an update to its October security bulletin and notified customers. The new element is a second way in. A third-party cloud provider that hosted Fireworks research and development machines suffered a security incident on October 23. The next day, the intruder used that access to reach Fireworks development machines and run an unauthorized workload.

Fireworks runs and fine-tunes open models on behalf of other companies and lists more than 10,000 customers on its website, according to Bloomberg. One of them, Notion, has told its own users that some Notion AI chat transcripts may have been exposed through the same incident, in fewer than 1% of workspaces. That carries the breach beyond developers to ordinary users of a productivity app.

1. What was exposed

The first incident was detected on October 6: someone used internal Fireworks credentials to read environment variables in evaluation jobs for a limited number of accounts, capturing API keys and tokens customers had stored as secrets. In its October 9 bulletin Fireworks said it had found no evidence of access to customer models, datasets, training data, personal information or inference traffic. The November 9 update widens that.

Fireworks has not said how many accounts are affected. Co-founder and CEO Lin Qiao, responding to concerns that weights had been stolen, said "From what we see attackers are not after weights" and that most downloads were partial and stopped, The Register reported. The bulletin notes the investigation is continuing and may reveal more.

2. Timeline and the LLMjacking attribution

Fireworks says evidence links the activity to a financially motivated criminal group whose aim is to sell tokens obtained through unauthorized access to large language models to illicit routing gateways. The bulletin calls this LLMjacking. It is the AI-era cousin of cryptojacking: instead of mining coins on someone else's machines, attackers steal the keys, tokens or compute that grant model access, resell the usage at a discount, and leave the bill with the owner. Inference platforms concentrate many customers' keys and large pools of GPUs in one place, which makes them attractive targets. Bloomberg reported that the criminal-group link concerns the early-October incident and that Fireworks did not say who carried out the October 24 intrusion.

Fireworks says it revoked and replaced credentials and service accounts, removed unnecessary elevated privileges, isolated affected systems, and disabled self-serve dataset uploads and downloads for batch inference and dataset-based training while the investigation continues. Palo Alto Networks Unit 42 is assisting with forensics, and law enforcement has been notified.

3. Notion users: who needs to rotate credentials

Notion says it used Fireworks for classification jobs and as a general inference provider. The data at issue is a set of Notion AI chat transcripts used for Insights, a feature that helps customers understand their own AI usage. Notion describes the transcripts as "unattributable": they carried no label identifying the author or workspace, and did not include tool call results such as page content pulled in by Notion AI. No other workspace data is affected, the company says.

Unlabeled is not the same as anonymous. Anything a user typed into the chat itself, including a name, a company or a password, remains in the text. That is why Notion tells affected customers to treat the data as exposed.

The credentials to rotate are not the Notion login itself but secrets for other services that were pasted into a Notion AI chat, such as a database connection string inside an error log or an API key embedded in a script. Notion has disabled Insights during its investigation and stopped serving open-weight models through Fireworks.

Teams that use Fireworks directly should follow the first bulletin's guidance: reissue revoked Fireworks keys, rotate any third-party credentials named in the notice with the issuing provider, and check for unfamiliar API keys, users, evaluators, training jobs and datasets. Deleting a stored secret does not invalidate the underlying credential.

4. What remains unknown

The timing is awkward for Fireworks. It was valued at $17.5 billion in July 2026, counts Nvidia and AMD among its backers, and is in talks for a new round at $30 billion or more according to The Information, or $30 billion to $40 billion according to Bloomberg. Summaries of The Information's reporting say some customers that spend millions of dollars a year are weighing other providers.

The incident follows a run of breaches at the edges of AI infrastructure in October, which we covered in our explainer on API key theft, our report on the OpenCode key leak, and our guide to the malicious LiteLLM 1.107.0 release. In each case the production service was not the first thing to give way. It was an evaluation job, a legacy system or an outsourced development machine, and customer keys were sitting there.