Fireworks AI's November 9 update says a second October intrusion exposed billing data and, for some accounts, secrets, datasets, and incomplete model weights. Notion says under 1% of workspaces had AI chat transcripts in the set.
On November 9, 2026, Fireworks AI updated its October security bulletin ↗. The first bulletin, dated October 9 by Fireworks, covered unauthorized use of internal credentials and secrets in evaluation-job environment variables. The Hacker News ↗ says detection was October 6 at 9:00 a.m. PDT and describes that notice as published October 10. The Register ↗ (November 10) and BleepingComputer ↗ reported the wider update. Fireworks gave no affected-customer count, and The Register noted that the update states none.
The new path is a supplier. A third-party cloud provider hosting Fireworks research-and-development machines had an incident on October 23. On October 24 the attacker reached Fireworks development machines and ran an unauthorized workload. Fireworks says it detected that the same day. As of October 25, it reports no further successful unauthorized access on the platform customers use.
Exposed data, in Fireworks' categories:
Resource metadata: identifiers, display names, descriptions, creation times.
Billing: billing and shipping addresses, invoice and payment history, account balance, credit usage. Fireworks says it does not store card numbers, and those numbers were not impacted.
Weights and datasets: for certain customers, a subset of incomplete model weights and datasets.
Secrets: for a limited set of accounts, secrets were impacted as well.
Fireworks ties the activity to LLMJacking, a financially motivated trade in stolen model access, and cites a November 2 Google Threat Intelligence Group and Mandiant post. We did not re-report that post. Fireworks says it told law enforcement and worked with Palo Alto Networks Unit 42 on credential rotation, network isolation, tighter storage access, and logging. Self-serve dataset upload and download for Batch Inference and dataset-based training are disabled during the investigation.
Fireworks says it has not detected impact to Inference, the Training SDK, or Nexus, and that those three are zero-data-retention by default. It also says the investigation is ongoing.
Notion's advisory, updated November 10 ↗, says this touches fewer than 1% of workspaces. It gives no count of workspaces or chats. Notion says it emailed the customers it identified. No email means that workspace was not identified, and no action is required right now. Notion says it will email you if that changes.
Notion's dates: November 2, synthetic test data only; November 3 morning, disconnected and deleted; November 6, potential customer data and a second investigation; November 8, final dataset confirmed; November 9, identified customers emailed; November 10, style edits only, with the facts unchanged.
Notion says the November 8 set included Notion AI chat transcripts used for Insights. For the vast majority of impacted workspaces they were "unattributable": no label for who wrote them or which workspace they came from, and no tool-call results. Insights is disabled. Notion no longer serves open-weight models through Fireworks. No other Notion feature was affected, Notion says.
The Register ↗ quoted an email Render founder Anurag Goel shared: Render may have been affected, and "some unattributable chat sessions with Notion AI may have been exposed." The same story quoted Fireworks CEO Lin Qiao: "From what we see attackers are not after weights" and "Most downloads were partial and stopped." The bulletin still says a subset of incomplete weights was accessed for certain customers.
The Hacker News ↗ reported a Reddit user writing, "looks like all of us are part of that <1%." Reddit was not reachable from this desk. That line is The Hacker News's attribution, not a count.
Fireworks customers
If the notice names secrets, rotate them, including evaluation-job keys. If it names weights or datasets, treat that subset as exposed. A weight file does not rotate like a key.
Card numbers were not in the set. Addresses, invoices, balances, and credit usage were.
No email is not an all-clear in the bulletin. Inference, Training SDK, and Nexus are where Fireworks says it has not seen impact, and the investigation is open. Dataset upload and download for batch and dataset training are disabled.
Questions go to the notice thread or security-notice@fireworks.ai.
Notion AI users
No email means the current instruction is to wait. Notion says it will write if your workspace is later identified.
If you were emailed, review the data in the workspace using the steps in that email. The public advisory does not paste them.
Treat the transcripts as exposed. Rotate passwords and API keys you pasted into Notion AI.
"Unattributable" is not "harmless" when the secret is in the text. Insights is off, and Notion has stopped using Fireworks for open-weight models.
""Unattributable" is doing limited work here. A secret doesn't need your name attached to be useful to someone else," wrote Hero.S ↗.
"A key can be replaced. Weights can't," wrote DailyAI ↗.
"Audit: list every AI vendor that receives raw prompts, and why," wrote Fenz AI ↗.
The API you call and the machine that was breached are different systems. Fireworks' zero-data-retention line covers Inference, the Training SDK, and Nexus. The second intrusion hit development machines through a supplier's R&D host. A retention label on the paid API does not describe every disk in the chain.
Insights was a second copy of the prompt. Those transcripts are the customer data in the November 8 set. Human review of Gemini connected apps is the same shape: the chat leaves for a job the user did not type.
Keys rotate. Weights do not. Read a training notice before the next job. Hosted-inference customers have a narrower bulletin. Vercel's ultrafast DeepSeek V4.1 Flash route is served by Fireworks. That is a dependency, not proof those calls were in the October 24 workload.
Write down every vendor that receives raw prompts, and why. Keys in agent folders belong on that list. See Claude Code settings and local secrets. Jobs you can run on weights you host leave this supplier. Start with the open-source LLM comparison, the local LLM comparison, and the coding-tool guide.