AI inference platform Fireworks breached, some customer data affected

AI inference platform Fireworks disclosed a security breach affecting customer accounts and billing information, with a small number of accounts also seeing API keys, datasets, and incomplete model weights compromised. The incident originated on October 23 at a third-party cloud provider hosting Fireworks' development machines, with attackers gaining access the following day and running unauthorized workloads; no further unauthorized access to the customer-facing platform has been detected since October 25. Exposed data includes billing addresses, invoices, and payment records, though Fireworks said it does not store card numbers, so those were unaffected. The company is investigating with Palo Alto Networks' Unit 42 and has temporarily disabled self-serve dataset uploads and downloads used for batch inference and dataset-based training. The disclosure matters as a reminder of third-party cloud risk for AI infrastructure providers; what to watch next is whether the investigation uncovers broader data exposure and when the disabled dataset features are restored.