Fireworks AI suffers second data breach, exposing Notion customer data

Fireworks AI has confirmed a second security breach in less than three weeks. This time, attackers walked away with customer billing information and some datasets.

At least one major customer, Notion, has already finished reading. It disconnected from Fireworks, deleted its stored data, and shut down the product feature that relied on the service.

How the attackers got in

Fireworks AI runs a platform that developers use to access and run open AI models.

According to the company’s latest security advisory, the attacker did not break into Fireworks directly. Instead, they compromised a third-party cloud provider that hosted Fireworks’ research and development machines.

That foothold, used on October 24, gave the intruder access to a Fireworks development system. From there, some customer data was within reach.

The exposed information includes billing details such as billing addresses, invoice history, and account balances. Resource metadata was also taken.

For a limited number of accounts, the damage went further. Datasets, secrets, and incomplete model weights were also exposed.

The October 6 incident

The October 24 breach followed an earlier incident detected on October 6. That one involved unauthorized use of Fireworks’ internal credentials and secrets.

Fireworks said the first breach did not expose customer models. The company initially downplayed how severe the access was.

Fireworks is now working with cybersecurity specialists from Palo Alto Networks Unit 42 on its investigation. The company says it is collaborating closely with affected customers, including Notion, Cursor, and Harvey.

Notion’s response: delete, disconnect, disable

Notion has been the most public about its exposure. The productivity company said less than 1% of its workspaces were affected.

The exposed data primarily consisted of AI chat transcripts from Notion’s Insights feature. Notion described those transcripts as unattributable, meaning they were not tied to identifiable users.

On November 3, it severed ties with Fireworks, deleted all data stored with the vendor, and disabled the Insights feature entirely.

It also stopped using Fireworks for open-weight model inference.

On November 9, Notion notified affected customers. It advised them to treat the data as compromised and to rotate credentials if any sensitive information had been involved.

Why the AI supply chain is the real story

Fireworks says it serves tens of thousands of customers worldwide. Notion, Cursor, and Harvey are among the better-known names on that list.

Many end users of Notion likely had no idea a company called Fireworks was processing their AI chats in the background.

In this case, the weak point sat two steps removed from Notion’s own systems. The cloud provider was compromised, which exposed Fireworks, which exposed Notion’s customers.

What this means for Fireworks and its customers

Cursor and Harvey are both named as affected customers.

The exposure of secrets for some accounts adds another layer of cleanup. Secrets typically include API keys and access tokens, so affected customers may need to audit what those credentials could reach.