Fireworks, an artificial intelligence infrastructure startup, recently disclosed a security breach involving unauthorized access to its development machines after attackers compromised a third-party cloud provider, as first reported by Bleeping Computer.
The incident, which occurred on October 23, allowed threat actors to access customer resource metadata, billing information, and incomplete model weights. This follows an earlier October security event where attackers targeted environment variables to steal API keys for Large Language Model hijacking, or LLM-jacking. In the latest breach, the unauthorized party gained entry through a third-party cloud provider hosting research and development machines.
Fireworks confirmed that while billing details were exposed, customer payment card numbers remained secure as the company does not store them. The startup has since revoked compromised credentials, isolated affected systems, and implemented stricter network access controls. Fireworks is currently collaborating with the Unit 42 incident response division of Palo Alto Networks to investigate the full scope of the intrusion and bolster its defenses.
This event highlights the growing industry risk of LLM-jacking, where stolen credentials lead to significant cloud AI charges. As of October 25, the company reported no further evidence of unauthorized access to its production platform.
Source: Bleeping Computer
