Fireworks AI’s Breach Turned Out Bigger, and Some Notion Workspaces Are Caught Up in It. Your Questions on the LLMjacking Attack, Answered
AI infrastructure provider Fireworks AI now says attackers reached billing details, resource metadata and some incomplete model weights and datasets, and links the intrusion to a financially motivated group that resells stolen access to AI models. Notion says fewer than 1% of its workspaces were affected.
When an AI provider first disclosed a break-in in October, the damage sounded contained. An updated notice published Monday tells a broader story, and one well-known productivity app has confirmed its customers were swept up as well. Here are the main questions, answered from the companies’ disclosures.
This Q&A is based on The Hacker News report on the widened Fireworks AI breach, with additional details from The Record.
Who is Fireworks AI?
It is an AI infrastructure company based in San Mateo, California, founded in 2022, that offers AI systems and tools to more than 10,000 business customers, according to The Record.
What did the company say at first?
Fireworks detected the activity at 9 a.m. Pacific time on October 6 and posted a notice on October 10. At that point it said internal Fireworks credentials had been misused to reach environment variables in evaluation jobs for a limited number of customer accounts, and that API keys and tokens stored there were captured. It said it saw no sign that models, datasets, training data, inference traffic or personal information had been touched. It revoked the compromised credentials and rotated service account tokens and affected API keys.
What changed in Monday’s update?
A second intrusion came to light. On October 23, attackers got into a third-party cloud provider, which Fireworks has not named, that hosted its research and development machines. The next day they used that foothold to reach Fireworks development machines and run an unauthorized workload that affected more customer data. Fireworks says it has seen no further successful access to its customer platform since October 25. Palo Alto Networks Unit 42 is investigating.
What data was exposed?
- Resource metadata, such as identifiers, display names, descriptions and creation times.
- Billing information: billing and shipping addresses, invoice and payment history, account balances and credit usage.
- A subset of incomplete model weights and datasets belonging to certain customers.
Fireworks says it does not store payment card numbers, so those were not affected, and that it is notifying customers whose data was involved.
Who is behind it, and what is LLMjacking?
Fireworks says the evidence points to a financially motivated cybercriminal group that sells tokens for access to large language models through illicit routing gateways. That is the pattern known as LLMjacking: hijack an organization’s access to AI models with stolen credentials, resell it, and leave the real account owner with the bill. Google Threat Intelligence Group and Mandiant, writing about LLMjacking last week, said they had seen fraudulent charges above $100,000 in a single day, and cumulative charges at some organizations reaching $1 million before access was cut off.
How is Notion involved?
Notion used Fireworks to classify usage for a feature called Insights and to serve open-weight models inside its product. It says fewer than 1% of its workspaces were affected. Notion learned of the incident on November 2, disconnected from Fireworks and deleted its data there. On November 6, Fireworks told it potential customer data may have been accessed, and Notion found the data included Notion AI chat transcripts used for Insights, which in most affected workspaces could not be tied to a person or workspace. Insights is turned off while the investigation continues, and Notion no longer serves open-weight models through Fireworks.
What should affected users do?
Notion advises customers to review the affected data inside their workspace and, if anyone pasted passwords, API keys or other credentials into it during the attack window, to rotate them immediately.
What this means for your company
Your AI tools are part of your supply chain, and so are the providers behind them. Find out which AI services your staff use, what data they send to them, and which vendors those services rely on. Treat AI API keys like any other credential: store them in a secrets manager, give each one only the access it needs, and rotate them on a schedule. Set spending alerts and usage caps on AI accounts so a hijacked key shows up as a billing spike in hours, not weeks. Finally, remind employees that pasting passwords or sensitive data into chat tools creates a copy you no longer control.
Want a clear picture of where your company’s data goes when people use AI at work? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
