How the Fireworks AI Breach Exposed Notion Transcripts and the LLMjacking Criminal Ecosystem
The software supply chain is only as strong as its weakest link — a principle that cybersecurity experts have repeated for decades without managing to prevent it from repeating itself. In November 2026, Fireworks AI, an artificial intelligence model hosting platform, suffered two breaches within two months, and the second one revealed not only direct customers' data, but a surprising twist: Fireworks was itself a victim. Among its customers was Notion, which, by disconnecting its AI tools from the platform, ended up exposing a fragment of the problem that the entire industry is trying to understand.
What happened at Fireworks AI is a case study on how an attack on AI infrastructure cascades through companies that never imagined they would be in the same data pipeline — while simultaneously revealing an emerging criminal ecosystem that analysts have dubbed "LLMJacking."
The breach and the unexpected discovery
On the evening of November 2, Fireworks AI notified Notion that a limited set of data had been accessed by malicious actors. At first, the set included only synthetic test data. Three days later, Notion proactively disconnected its systems from Fireworks, deleted all data stored in the platform's system, and cut all communication between the two services.
On November 6, Fireworks reported that malicious actors may have accessed customer data. Notion launched a new internal investigation. It was on November 8 that Fireworks confirmed the final affected dataset. On the morning of November 9, Notion reached out to impacted customers.
The discovery came from analyzing that final dataset: Fireworks had provided Notion with a file containing Notion AI chat transcripts used in the "Insights" feature. The transcripts included "any input to or output from the model that was written to the chat," as Notion described in its official disclosure. The company emphasized that much of the data was unattributed and could not be determined as belonging to which customer. The more concerning aspect is that, beyond the transcripts themselves, there is no additional information linking the conversations to workspaces, users, or companies — a partial relief for those fearing direct exposure.
On November 12, Notion disclosed that third-party API keys found in affected messages were also reported to the vendors that issued them. The company recommended that affected customers treat the data as if it were exposed and, if they had pasted sensitive information, passwords, or API keys into Notion AI during the incident period, to replace them.
Two breaches, two vectors
What makes the Fireworks AI case particularly instructive is that it is not a single event, but two distinct breaches in October, as the company confirmed in its security bulletin. The first breach occurred through compromised internal credentials, which allowed access to environment variables used in customer evaluation jobs, including API keys and tokens stored as secrets. The second breach happened through a third-party cloud provider hosting Fireworks' R&D machines.
The combination of these two vectors created a complete path for the attackers: first, they accessed secrets stored in customer evaluation jobs, then expanded their reach through the compromised cloud provider. The result was a cascading access that hit resource metadata, account and billing information, and — for a limited set of accounts — secrets, datasets, and incomplete model weights.
That last detail is particularly interesting. Incomplete model weights are partial training checkpoints that can reveal information about a customer's fine-tuning process, their training strategies, and potentially about their own models. Fireworks has not disclosed financial losses, but the scope of the exposure is significant.
LLMjacking: the crime fueling the incident
Fireworks believes the attackers are financially motivated and their goals are focused on selling tokens by accessing language models without authorization. These schemes rely on resale to unauthorized third parties, who can consume AI resources without using their own resources — a phenomenon that Google Threat Intelligence Group (GTIG) and Mandiant documented as "LLMJacking."
In a November 2026 report, GTIG described a specialized criminal ecosystem in which "LLM Mixers" — criminal routing gateways that aggregate compromised API credentials and resell model access to underground subscribers — act as the center of the monetization infrastructure. One such service, called Jet Night, offered an "unlimited" plan for about US$ 60 per month. In one incident, a Jet Night operator made more than 500,000 API calls in under eight hours, generating almost US$ 1 million in token costs that landed on the victim's invoice.
The direct connection between the Fireworks attack and LLMjacking is still under investigation. Fireworks identified evidence linking the activity to financially motivated criminals involved in LLMjacking. GTIG, meanwhile, has not identified a direct connection to the Fireworks breach, although the modus operandi is consistent with the LLMjacking campaigns mapped by the group.
The weak link in the AI supply chain
The Fireworks and Notion case illustrates something that is becoming increasingly evident: the AI supply chain is exponentially more complex and vulnerable than the traditional software supply chain. A company using a third-party AI service may, without realizing it, be storing sensitive data on a platform that, in turn, depends on dozens of other providers.
Notion is not an exception — it is a symptom. The company affected roughly 1% of its own customers through this indirect connection, but the number of compromised workspaces is proportional to the volume of integration. Hundreds of thousands of developers use Fireworks AI to serve their own products, and each of these developers carries, by extension, the security risks of its infrastructure.
What makes the case even more troubling is the timing: we are in 2026, a year in which generative AI adoption in the enterprise has reached unprecedented levels. Companies are integrating AI agents into their workflows, connecting productivity tools to language models, and relying on third-party platforms to manage critical data. Every connection is a potential attack vector.
What to watch
The Fireworks AI and Notion case raises questions that go beyond a single incident. The convergence between credential breaches, LLMjacking, and AI supply chain vulnerabilities suggests that the coming months will see more similar cases — and possibly at a larger scale.
The question that remains is: when every company in the AI ecosystem depends on dozens of third-party providers, how can we ensure that the security of the entire chain does not reduce to the weakness of the most exposed link?
Sources: TechCrunch, Notion, CSO Online
✓ Independent sources cross-checked and verified before publishing
