Fireworks AI: When the AI Supply Chain Becomes an Attack Vector

The artificial intelligence infrastructure is becoming increasingly interdependent. And that interdependence creates single points of failure that cybercriminals are learning to exploit with increasing speed and precision. The Fireworks AI case — an Nvidia-backed startup that runs language models for thousands of companies — illustrates this systemic risk vividly.

On November 2, Fireworks AI notified Notion that a set of data had been accessed by malicious actors. What unfolded revealed a compound incident: rather than a single attack, it was a sequence of chained exploits that began in October and was only fully mapped by November 8, when Fireworks confirmed the final scope of the compromise.

The broken architecture of trust

Fireworks AI positions itself as a platform for developers to access and run open-source AI models. According to the company, it has over 10,000 customers, including Notion, Cursor, Harvey (an AI-powered law firm), and Lightning AI. Financially backed by Nvidia, it sits at the center of the AI infrastructure ecosystem.

The attack did not hit Fireworks directly. According to a security bulletin published on November 9, the vector was a third-party cloud provider hosting Fireworks' R&D machines. On October 23, an unauthorized third party exploited that provider to access Fireworks' development machines. The next day, the attacker ran an unauthorized workload, resulting in the compromise of customer data.

Fireworks detected the activity on the same day and remediated the critical vulnerabilities. But the damage had already spread.

What was exposed: the Notion case

Notion was one of the most visibly affected companies. According to a security statement published on November 12 and updated on November 10, the attack allowed attackers to access chat transcripts from Notion AI customers who used the "Insights" feature. This feature, which helped customers understand their AI usage patterns, relied directly on processing done through Fireworks.

Notion acted swiftly: on November 3, it disconnected its systems from Fireworks, deleted all data stored in the Fireworks platform, and terminated all communication between the two companies. The company says less than 1% of its workspaces were affected.

One important detail: most of the compromised transcripts were "unattributed" — meaning they were not labeled with user identity or workspace origin. "Beyond what's in the chat transcript itself, there's no information tying the chat back to workspaces, users or companies," Notion stated.

Still, the company advised affected customers to treat the data as if publicly exposed. If users had entered sensitive information, passwords, API keys, or other credentials into Notion AI during the incident period, they were instructed to rotate them immediately.

The LLMJacking pattern

This was not Fireworks' first incident in 2026. On October 25, the company had already notified customers of a previous attack — this one through compromised internal credentials. Within weeks, the startup suffered two distinct breaches.

But what makes the second attack particularly revealing is that it is part of a broader campaign that Google Threat Intelligence Group and Mandiant have called LLMJacking: criminals exploiting language models to mine access tokens and sell them to illicit routing gateways.

SecurityWeek documented that in October 2026, at least a dozen AI infrastructure companies were hit by the same attack pattern: Andromeda, Brev (Nvidia), CommandCode, Fireworks AI, Lightning AI, Northflank, OpenCode, Railway, Trigger.dev, Warp, and Zeabur. The target was consistent: stored customer secrets — API keys, session tokens, credentials.

Chainstack, hit on October 26, saw attackers access a development environment and, through a third-party component, parts of its production environment. WorkOS, on October 30, had sales data and customer communications exposed. Fireworks, in its second breach, had access to model weights and customer datasets.

The systemic risk of AI infrastructure

The Fireworks/Notion case reveals a dynamic that will repeat: when a company depends on an AI inference provider for core functionality, it is not just outsourcing compute — it is outsourcing security trust. Data that never left Notion's servers could end up in third-party systems that process, cache, or aggregate information for analytical purposes.

Notion disabled the Insights feature and stopped serving open-weight models through Fireworks. But the broader question is that the AI inference infrastructure itself — the digital "undersea cable" connecting hundreds of startups to powerful models — has become a concentrated target. Attackers know that compromising a single provider like Fireworks can grant access to data from thousands of indirect customers.

Fireworks says its inference, training SDK, and Nexus systems operate with zero data retention (ZDR) by default — and that no impact was detected in those areas. However, the very existence of this layered architecture, where data flows between third-party providers and systems, creates attack surfaces that multiply geometrically.

The question is: how long can AI infrastructure scale without a native security layer that considers not just the protection of the individual provider, but the resilience of the entire chain of connectable customers?

What to watch in the coming months

Three developments deserve attention:

1. AI supplier security regulation. The European Commission is already debating supply chain due diligence rules — the Fireworks case may accelerate the application of those rules to AI inference providers. In October 2026, the EU had already included AI risk management requirements in safety legislation.

2. Migration to zero-retention providers. The trend toward zero data retention in inference systems may shift from a marketing differentiator to a minimum contractual requirement. Companies currently using Fireworks, Together AI, or other providers should evaluate whether their current providers meet that standard.

3. Supply chain security audits. Fireworks has pledged to review and restrict access to data storage and analytics systems. It is likely that other AI infrastructure companies will do the same — and that investors like Nvidia, which backs Fireworks, will demand security audits as a condition for continued funding.

Sources: TechCrunch, SecurityWeek, Bloomberg

✓ Independent sources cross-checked and verified before publishing