Back to News

Fireworks Breach: Hackers Accessed Some Customer Datasets, Model Weights, Billing Info

#fireworks#security#ai infrastructure#breach

AI infrastructure provider Fireworks reported a security breach in which hackers accessed some customers' datasets, incomplete model weights, and billing information over the past month, according to Forbes. Two customers told Forbes they had already largely moved their business off Fireworks' systems, with one describing a series of issues. The breach highlights ongoing security concerns for AI infrastructure providers and their enterprise customers.

Coverage timeline

  1. Techmeme
    AI infrastructure provider Fireworks says hackers accessed some customers' datasets, incomplete model weights, and billing information over the past month (Anna Tong/Forbes)

    Anna Tong / Forbes : AI infrastructure provider Fireworks says hackers accessed some customers' datasets, incomplete model weights, and billing information over the past month — Two customers told Forbes they had already substantially moved their business off Fireworks' systems, with one describing a series …

Related stories

  • OpenCode Maker Anomaly Innovations Reports Breach of ~1.4% of Console Users' API Keys

    Anomaly Innovations, maker of the open-source coding agent OpenCode, disclosed a breach affecting roughly 1.4% of OpenCode Console users and their API keys, describing it as a large-scale distillation attack. Hackers accessed part of the online platform, stole API keys, and ran up charges on users' AI accounts; the AI tools OpenCode relied on reportedly refused to analyze the malicious code.

    2 reports · 2 sources

  • Railway reports unauthorized access to customer environment variables

    Cloud provider Railway detected anomalous activity in systems storing customer environment variables, and reported that an unauthorized party may have accessed encrypted variables and, for some customers, obtained decrypted contents. The incident affects developer infrastructure and was disclosed on October 22, 2026.

    1 reports · 1 sources

  • PHP2Shell critical RCE flaws patched; exploited before disclosure

    PHP released security updates (8.5.12, 8.4.27, 8.3.36, 8.2.35) fixing two critical unauthenticated remote code execution vulnerabilities, collectively dubbed PHP2Shell, affecting up to 70% of websites. The flaws were discovered in August by OpenAI's GPT-5.6 Sol and independently by Google's Wiz, and AWS reported exploitation starting October 17, four days before public disclosure.

    6 reports · 2 sources

  • NYT, Other Publishers Sue Brave Over AI Scraping and Paywall Bypass

    The New York Times and a group of other publications, including the companies behind the New York Daily News, Chicago Tribune, and Orlando Sentinel, have filed lawsuits against Brave Software. The complaints allege that Brave monetized its scraped website index by providing AI companies with paid access to real-time online content for model training and user query responses, and that its browser lets users bypass paywalls.

    1 reports · 1 sources

News updates every hour. Subscribe in your RSS reader to get new stories automatically.

Subscribe