Fireworks AI Confirms Another Cyberattack on Its Infrastructure

AI infrastructure startup Fireworks has officially announced that its systems have been hit by another cyberattack. The incident, which occurred at the end of October, is directly linked to a third-party cloud service provider that hosted the startup's research and development (R&D) servers. ## What happened at Fireworks? On October 23, hackers gained access to Fireworks' development machines and proceeded to run unauthorized workloads within the system. According to the company, the attackers accessed customer resource metadata, billing details—such as payment history and postal addresses—as well as some clients' incomplete models and databases. It is important to note that customer bank card details were not compromised, as Fireworks does not store payment card information itself. This incident marks the second such event for the company in October. An attack earlier in the month allowed cybercriminals to gain access to API keys and tokens, facilitating what is known as "LLMJacking." This process involves hackers stealing access codes for large language models (LLMs) and selling them on illegal services, often resulting in massive financial losses for the victimized companies. ## Security measures and future plans Immediately upon discovering the incident, Fireworks activated its security protocols. The company revoked compromised service accounts, restricted network access, and isolated the affected systems. The startup is currently working closely with the Unit 42 team at Palo Alto Networks to fully investigate the scale of the attack and prevent similar threats in the future. Fireworks leadership states that no signs of unauthorized access have been detected in the system since October 25. ## Why this matters Fireworks is a platform that helps developers run open-source AI models, such as Llama, Mistral, or Gemma, without facing complex infrastructure challenges. The breach of such platforms poses a significant risk, as they often store confidential client data and access keys to expensive computing resources. Recently, the number of attacks on LLMs has increased globally. According to Google security researchers, fraudulent activities carried out using stolen API keys can cost companies up to a million dollars in damages. For users and the technology sector, this serves as another reminder that security audits and constant monitoring of access keys are critically important when utilizing AI services.