Introduction
I have read a lot of breach disclosures, and I have learned to pay attention to the second one. The first is almost always the optimistic version — written while a company still hopes the damage is contained. The second is written after forensics has actually finished looking.
Fireworks AI just published its second disclosure, on November 9, 2026, and it tells a very different story from the first. When the provider first told customers about the incident on October 9, it said it had not detected access to customer models, datasets, training data, personal information, or inference traffic. A month later, the harder truth: attackers got into billing information, secrets, customer datasets, and portions of unfinished AI models.
This breach matters to people like me — I build websites, and I use AI services the same way most developers do: API keys in environment variables, a model hosted somewhere else, a feature that calls out to an inference platform and comes back with an answer. It matters because of what it reveals about where the AI economy is actually vulnerable. The attackers were not really after Fireworks. They were after the keys, the data, and the model access that Fireworks holds on behalf of roughly 10,000 enterprise customers — companies including Uber, Shopify, and Cursor, according to reports this week. The company was valued at $17.5 billion in July, and two of its customers have already told Forbes they have substantially moved their business elsewhere.
What Actually Happened: A Timeline in Two Acts
The breach unfolded in two distinct acts, weeks apart, and that gap is the most important detail in the whole story.
Act one: October 6. Fireworks AI identified unauthorized use of its internal credentials. Customer notifications began on October 7, and the company published its first security bulletin on October 9. At that point, its position was that the incident involved internal credentials and a limited number of customer accounts, with no detected access to customer models or datasets.
Act two: October 23–24. A third-party cloud provider that hosted Fireworks AI's research and development machines experienced its own security incident on October 23. The next day, the unauthorized party used that access to reach Fireworks' development machines and run an unauthorized workload that led to additional customer data impact. Fireworks says it detected this activity the same day and closed known critical vulnerabilities. As of October 25, the company says it has not detected further successful unauthorized access on its customer platform.
The revised disclosure: November 9. In a follow-up security bulletin, published with forensic assistance from Palo Alto Networks' Unit 42, Fireworks expanded the scope considerably. The attackers had accessed account and billing information and, for a limited group of customers, secrets, datasets, and incomplete model weights. Bloomberg called it Fireworks' second hack disclosure in weeks; Forbes reported two customers had already moved substantial business off the platform.
This was not one breach. It was an initial compromise followed by a second intrusion through a completely different door — a supplier's infrastructure — more than two weeks later, while the first incident was still being investigated.
What Was Taken — and What Wasn't
Precision matters in a breach story, because the difference between "some data" and "your model weights" is the difference between a bad week and an existential problem. Here is what Fireworks says was accessed:
Account and billing information. Billing records were exposed: billing and shipping addresses, invoice and payment history, account balances, and credit usage, along with resource metadata such as identifiers and display names. One piece of good news: Fireworks says it does not store payment card numbers, and those were not affected.
Secrets. For a limited set of accounts, secrets were accessed. Fireworks has not published a full itemized list, but on an AI inference platform, "secrets" means API keys, tokens, and credentials — the currency of this whole ecosystem.
Datasets and incomplete model weights. This is the part that changed the story. For certain customers, portions of datasets and incomplete model weights were accessed. Model weights are the numerical values that make up a trained model — the product itself for companies that fine-tune models. Fireworks has not said that complete customer models were stolen, and that distinction matters. But incomplete weights and datasets are still intellectual property, and their exposure creates real risk depending on what was in those files.
What Fireworks says was not affected. The company says it has not detected impact to its Inference, Training SDK, or Nexus services, which it describes as zero data retention by default. Affected customers are receiving account-specific details and recommended response actions, and the investigation is ongoing, so more findings may follow. The company has also disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training while it investigates — a significant operational sacrifice that tells me it treats the dataset path as genuinely compromised. Fireworks says it has notified law enforcement, brought in Palo Alto Networks' Unit 42 for forensics, revoked compromised credentials, and restricted access to affected systems.
LLMjacking: The Motive That Explains Everything
If you are wondering why anyone would bother breaking into an AI inference platform twice, the answer has a name now, and it is one I have written about before: LLMjacking.
LLMjacking is the theft of access to large language models for resale. Attackers steal API keys and credentials, then sell discounted access to powerful models through underground services — illicit routing gateways that Google's Threat Intelligence Group and Mandiant, in a November 2 investigation, called "LLM Mixers." The buyer gets cheap model access. The seller gets paid. The victim gets the bill.
Fireworks says evidence links its breach to a financially motivated cybercriminal group aiming to sell tokens from unauthorized access to large language models through exactly these illicit routing gateways. This is not espionage or hacktivism — it is a business model, because a single stolen enterprise key can be resold many times over and run up enormous usage before anyone notices. According to Wiz, two enterprise keys taken from vendor breaches were validated within 30 minutes and then used for hundreds of thousands of model calls.
I covered this wave earlier this month, when Google and Mandiant found stolen keys running up bills of $1 million in a day. The Fireworks breach is the same story from the other side of the glass: the platform that held the keys got breached, and the keys became the product.
Black October: Fireworks Was Not Alone
The Fireworks breach looks less like an isolated incident and more like a symptom once you zoom out. Wiz published research on October 30, 2026, documenting that at least nine AI developer platforms disclosed security incidents in October alone: Fireworks AI on October 6, Andromeda on October 9, Zeabur on October 14, Lightning AI on October 15, OpenCode on October 16–17, Railway on October 20, Warp on October 23, CommandCode on October 28, and Northflank on October 30.
Wiz says almost all of them involved targeted hunting for stored environment variables — especially the ones that grant access to AI models. No single vulnerability or dependency ties the incidents together, and most investigations are still ongoing.
We spent the last two years racing to put AI into everything — chatbots, coding agents, image generation. Every one of those integrations is a credential sitting somewhere: in an environment variable, in a platform dashboard, in a third-party service we trusted. The October wave shows that attackers have figured out the economics. Why phish one developer's key when you can breach one platform and harvest thousands?
What This Means for WordPress and Elementor Site Owners
You might be reading this and thinking, "I don't use Fireworks AI, so this doesn't affect me." I understand that instinct, and I think it is wrong — not because your data was in this breach, but because the pattern behind it applies to almost every site I work on.
Most WordPress sites that use AI do it through a plugin or a third-party service — a chatbot, a content writer, an image generator. Behind every one of those features is an API key, and that key lives somewhere — in your wp-config.php, in your hosting environment variables, in a plugin's settings page, or in the dashboard of the service that powers the plugin. You may not know where it is. The attackers do not care. They are working through the platforms systematically.
The Fireworks breach also exposes a risk I think about a lot as a WordPress developer: the supply chain. Fireworks' second intrusion did not come through its own front door. It came through a third-party cloud provider hosting its R&D machines. Your site has the same shape of exposure — hosting provider, CDN, plugin vendors, theme shop, the AI service behind your chatbot — each one is a door into your site, and you do not control their locks. When your AI provider has a bad month, most small sites have no second provider ready. That is worth fixing before you need it.
What To Do Tonight: A Checklist
A checklist does not fix a systemic problem, but these steps genuinely reduce your exposure, and most take less than an hour.
1. Rotate every AI API key you control. If a key has been sitting unchanged for months, it is a liability. Generate a fresh key, update your site or service, and revoke the old one. Do this first.
2. Find out where your keys actually live. Search your wp-config.php, hosting environment variables, plugin settings, and any .env files for API keys. If a key is hard-coded in a theme or plugin file, move it to an environment variable or a secrets manager. A key in version control is a key that has already leaked — check your git history too.
3. Set billing alerts and usage caps on every AI account. LLMjacking works because stolen keys can run up huge bills before anyone notices. Set a monthly spending cap and email alerts at usage thresholds — low enough that a stolen key hurts a little, not catastrophically.
4. Check whether your vendors were in the October wave. If you use Fireworks, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode, or Northflank — or any AI developer platform — check their security bulletins and assume stored credentials may be exposed until the vendor says otherwise. Rotate keys, review access logs, and look for usage you do not recognize.
5. Enable the boring protections. Two-factor authentication on every account that touches your site or your AI services. Separate API keys per environment — never reuse your production key in staging or local dev. Restrict keys by IP or referrer where the provider allows it. None of this is exciting. All of it works.
6. Watch your AI bills for the next month. Look for usage spikes, unfamiliar models being called, or calls at hours when nobody works. LLMjacking traffic often looks like a sudden, sustained jump in token usage. If you see it, revoke the key immediately and then investigate — in that order.
Conclusion
Fireworks AI's November 9 disclosure is a story about a breach that got worse before it got better, and about a company that had to correct its own first account. That is uncomfortable, but I would rather have the corrected version than the comfortable one. The corrected version tells us something important: the attackers came back through a supplier, they took datasets and model weights, and their motive was the resale economy that now surrounds stolen AI access. The October wave — nine platforms in a month, all hunted for the same thing — tells me this is not going to stop.
Security is a process, not a product, and tonight the process is a checklist and an hour of your time. Do it before the next disclosure lands, because the next one will also be worse than the first version.
---
Frequently Asked Questions
What exactly did Fireworks AI disclose on November 9, 2026?
Fireworks AI expanded its disclosure of an October security incident, revealing that attackers had accessed account and billing information and, for a limited group of customers, secrets, datasets, and incomplete model weights. The company's first bulletin on October 9 had described unauthorized use of internal credentials and said it had not detected access to customer models or datasets.
What is LLMjacking, and why was Fireworks targeted?
LLMjacking is the theft of API keys and credentials that grant access to large language models, which criminals then resell through illicit routing gateways — underground services Google and Mandiant call "LLM Mixers." Fireworks says evidence links its breach to a financially motivated group pursuing exactly this scheme, because a single stolen enterprise key can be monetized through hundreds of thousands of model calls.
Were complete AI models stolen in the Fireworks breach?
Fireworks has not reported that complete customer models were stolen. The disclosure covers portions of datasets and incomplete model weights for a limited set of customers. The company says it has not detected impact to its Inference, Training SDK, or Nexus services, which use zero data retention by default.
Were payment card numbers exposed?
No. Fireworks says it does not store payment card numbers, and they were not affected. Billing information that was accessed includes billing and shipping addresses, invoice and payment history, account balances, and credit usage.
Was Fireworks the only AI platform breached in October 2026?
No. According to Wiz research published October 30, at least nine AI developer platforms disclosed security incidents in October 2026, including Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode, and Northflank. Almost all involved targeted hunting for stored environment variables, especially keys granting access to AI models.
What should I do if my site uses an AI API key?
Rotate the key, move it out of code files into environment variables or a secrets manager, set a billing cap and usage alerts, enable two-factor authentication on the account, and monitor usage for unexplained spikes. If you use any platform named in the October wave, check its security bulletin and assume stored credentials may be exposed until the vendor confirms otherwise.
