Fireworks AI Breached Again: API Keys and Customer Billing Data Stolen

Fireworks AI, an AI infrastructure startup that helps developers run models like Llama and Gemma, has disclosed a second security breach in less than a month. Attackers first stole API keys and tokens in an early October incident. Then, on October 23, they struck again by compromising Fireworks' development machines through a hacked third-party cloud provider, accessing customer billing addresses, account balances, and even incomplete AI model data.

For engineers using Fireworks' platform, this means revoked API keys and potential exposure of their billing information. The attackers, linked to 'LLMJacking' schemes that sell unauthorized AI model access, highlight the growing security risks in the AI-as-a-service ecosystem. The takeaway: even when outsourcing complex AI infrastructure, your data's security is only as strong as your provider's weakest cloud vendor link.