Observed incident

Fireworks AI reports unauthorized access to evaluation-job secrets

Reported

Published here

What happened

A third party used internal Fireworks credentials to read evaluation-job environment variables for a limited set of accounts. The company believes the variables exposed API keys and tokens.

Parties and reporting

AI tools and systems: Fireworks AI evaluation jobs, Fireworks API keys, Third-party credentials

Outcome

Fireworks notified identified customers, revoked affected and attacker-created keys and rotated employee keys and service tokens. It found no evidence of access to models, training data, personal information or inference traffic within its perimeter.

Operating lesson

Rotate exposed third-party keys at the issuer, update dependent jobs and check downstream logs for unauthorized reads or new keys.

Evidence and limits

October 6 was detection and October 7 began direct customer notifications. The public bulletin appeared October 9 at 10 p.m. PDT. Fireworks did not establish the total downstream impact or attacker AI use.

Sources