What happened
Fireworks AI disclosed that a breach first reported on October 9 had broader consequences than initially believed. While the original incident involved unauthorized use of internal API keys on October 6, a follow‑up investigation announced on November 9 revealed that attackers accessed resource metadata, billing information—including customer addresses, invoices, payment history, account balances and credit usage—and, for a limited set of accounts, secrets, datasets and incomplete model weights. The breach also affected Notion, which uses Firewalls AI’s infrastructure for its Insights ; Notion confirmed that chat transcripts were exposed and revoked compromised API keys on November 11. Firewalls AI maintains that its core , Training SDK, and Nexus services, which operate with zero‑data‑retention by default, were not impacted.
Fireworks AI first disclosed a breach on October 9 after detecting unauthorized use of internal credentials on October 6. The initial statement said attackers accessed environment variables containing API keys and tokens used in evaluation jobs for a limited number of customer accounts, but no customer models, datasets, personal information, or traffic appeared to be compromised.
An expanded investigation, conducted with Palo Alto Networks' Unit 42, was announced on November 9. This follow‑up revealed that attackers accessed broader resource metadata and billing information, including customer addresses, invoices, payment histories, account balances, and credit usage. For a small subset of accounts, the breach also exposed secrets, datasets, and incomplete model weights.
Notion, which relies on Fireworks AI for its Insights , confirmed that chat transcripts processed through the service were accessed. On November 11, Notion revoked the exposed API keys discovered in affected users' messages, mitigating further risk.
Fireworks AI asserted that its core , Training SDK, and Nexus services—designed with zero‑data‑retention (ZDR) by default—were not impacted. However, the incident highlighted that evaluation jobs, stored datasets, and development environments can create separate exposure points outside the ZDR scope.
The breach raises broader concerns for CX leaders about the visibility and control they have over third‑party AI infrastructure, especially regarding how customer data and proprietary model assets are stored, processed, and protected.
Why it matters
The breach underscores the hidden security risks in enterprise AI supply chains, where third‑party infrastructure providers handle sensitive customer data beyond a company’s direct control. Enterprises often share personal details, account information, and proprietary model assets with AI platforms without full visibility into how those providers store or protect the data. The exposure of billing records and incomplete model weights demonstrates that even non‑production assets can be valuable to attackers, potentially enabling credential stuffing, fraud, or intellectual property theft. Moreover, the incident highlights the difficulty of quickly assessing downstream impact when a supplier is compromised, a challenge for CX and security teams tasked with maintaining customer trust. As noted by Zoho’s AI research director, the reputational damage from privacy or security breaches can outweigh the productivity gains promised by AI tools. The Notion exposure further illustrates how downstream applications can inherit risk from shared infrastructure, prompting a need for tighter governance and auditability across the AI supply chain.
Enterprise AI deployments increasingly rely on external infrastructure providers, creating a supply‑chain risk where a breach at a vendor can expose sensitive customer data and proprietary AI assets.
Billing information and incomplete model weights, while not full production models, can still be leveraged for fraud, credential stuffing, or competitive intelligence, amplifying the potential impact of the breach.
The incident demonstrates the difficulty of quickly mapping the downstream impact of a supplier breach, a challenge for organizations that must assess which of their own services and customer interactions may have been compromised.
Regulatory scrutiny is intensifying, as illustrated by the UK ICO’s call for evidence on data‑protection law for agentic AI, suggesting future compliance obligations for AI‑driven customer interactions.
Reputational risk from such breaches can outweigh productivity gains from AI tools, influencing enterprise decisions about adopting or continuing to use third‑party AI services.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
crm_get_transaction(id='4092').A public chatbot and an internal agent with write access are being assessed. Why need separate threat models?
What to watch next
Watch for increased scrutiny of AI‑service provider contracts, especially clauses around data retention, encryption, and breach notification. Enterprises may adopt stricter vendor risk assessments and demand zero‑data‑retention guarantees for evaluation workloads. Regulatory bodies, such as the UK ICO, are also seeking evidence on how data‑protection law applies to agentic AI, which could lead to new compliance requirements for AI‑driven customer interactions. Finally, monitor whether Fireworks AI introduces additional security controls or third‑party audits to restore confidence among its customers.
Enterprise contracts with AI providers may start to include stricter data‑retention, encryption, and breach‑notification clauses, as well as requirements for regular third‑party security audits.
The ICO’s agentic AI consultation could result in new guidance or regulations that affect how businesses deploy AI agents handling personal data, potentially mandating higher transparency and accountability standards.
Fireworks AI’s response—whether it introduces additional security controls, offers more granular data‑access logs, or undergoes independent security certifications—will be closely monitored by current and prospective customers.
Other AI‑dependent services, like Notion, may reassess their reliance on shared infrastructure and consider alternative architectures or additional safeguards to limit exposure.