Fireworks AI told customers on Nov. 9 that hackers hit it twice in 18 days2. The company rents AI models to other businesses, and investors valued it at $17.5 billion this July3. This time the hackers took billing records and, for some customers, pieces of their own AI models.
A Second Break-In, 18 Days Later
Fireworks caught an intruder on Oct. 6. Someone had stolen its internal login credentials3. Fireworks told the public three days later, on Oct. 92.
The company believed the breach was over. A second attack arrived instead.
On Oct. 23, a cloud provider hit a security problem of its own2. Fireworks rents development machines from that provider. The next day, the same intruder reached those machines directly.
Fireworks AI's Second Hack Began 18 Days After Its First
Dated events in Fireworks AI's two 2026 security incidents, Oct. 6 to Nov. 9
Each dot marks one dated event; the magenta dot is the moment the second intruder reached Fireworks' own machines, 18 days after the first breach began.
Sources: Fireworks AI [2]; FourWeekMBA [3]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Date | Event |
|---|---|
| Oct. 6, 2026 | First breach caught. Stolen internal credentials |
| Oct. 9, 2026 | First breach disclosed. Fireworks posts its first bulletin |
| Oct. 23, 2026 | Cloud provider hit. Third-party cloud incident |
| Oct. 24, 2026 | Second breach begins. Intruder reaches dev machines |
| Nov. 6, 2026 | Notion notified. Private warning to Notion |
| Nov. 9, 2026 | Second breach disclosed. Public update, Notion and Cursor named |
The second break-in reached further than the first. Fireworks says the hackers took billing addresses, invoices, payment history and account balances2. For some customers, they also took pieces of unfinished AI models and the data used to train them.
Notion was one of the customers caught in the breach. It got a private warning on Nov. 61. Fewer than 1 percent of its workspaces were touched, Notion says.
The exposed chats arrived unlabeled, missing the writer and the workspace. Their actual words stayed real.
Fireworks blames a cybercrime group chasing money, a different kind of threat than a government or a rival6. The group planned to resell stolen access to AI models through black-market routing sites. Security researchers call that scheme LLMjacking. Fireworks hired the cybersecurity firm Palo Alto Networks' Unit 42 to dig through the wreckage.
Why Customers Keep Paying Fireworks
You might expect customers to flee after two breaches in 18 days. They stayed anyway.
Ron Patel covers AI infrastructure for Startup Fortune. He found only a couple of clients have actually switched providers so far5. The reason traces to chip scarcity, rather than trust. "Security incidents usually cost a vendor customers because switching is cheap enough to punish bad behaviour. Here it isn't," Patel wrote.
Fireworks runs its customers' products on scarce Nvidia chips5. Buyers tune those chips to the speed and price their own products already promise shoppers.
Moving that work to a rival means finding the same chips somewhere else. Every AI company wants that same hardware right now. Chips decide.
That scarcity buys Fireworks room to operate. A vendor in a calmer market would have to earn that room the hard way.
Even scarcity has a limit, though. Gennaro Cuofano writes for FourWeekMBA. He reported that people familiar with the matter told The Information that some big-spending clients are weighing a move to other providers3. Fireworks had already named Harvey, the legal AI company, among the customers it was walking through the incident.
Two days before Fireworks admitted the second breach, Dave Wehner posted on X that he was joining the company3. He would run its finances. Wehner ran Meta's books from 2014 to 2022, and the timing put a finance veteran in the seat just as the bad news broke.
The Case for Walking Away
Jason Lemkin rejects the idea that scarce chips should buy anyone calm. He built the SaaStr investor community, and he posted his own warning the day the second breach became public4.
Jason ✨👾 SaaStr.Ai✨ Lemkin@jasonlkEveryone is getting hacked and everyone is going to get hacked
It’s only accelerating and going to accelerate more and more with agents
Please, please go talk to your team about this
If they aren’t taking it extremely seriously, you need to drive change. You will be hacked. https://t.co/yW2N5BW3cW
"Everyone is getting hacked and everyone is going to get hacked. It's only accelerating and going to accelerate more and more with agents," Lemkin wrote4. He told his followers to check with their own security teams first. The warning was literal.
His post quoted an earlier one from the reporter Natasha Mascarenhas. She had just confirmed Fireworks was working with Notion and Cursor to contain the breach9.
Practitioners on Hacker News pushed the same worry, in sharper words than Notion used8. Commenters argued the exposed chat transcripts carried the real risk. The words inside them stayed fully intact, metadata aside.
Fireworks Told the Public in 3 Days the First Time, 16 the Second
Days from the start of each Fireworks AI breach to its public disclosure, 2026
Each dot is one breach: the blue dot is the first breach's 3-day gap to disclosure, the magenta dot is the second breach's 16-day gap, and the rod shows how much slower the second response ran.
Sources: Fireworks AI [2]; FourWeekMBA [3]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Item | First breach | Second breach |
|---|---|---|
| Days to public disclosure | 3 days | 16 days |
Fireworks took three days to tell the public about its first breach, and it took 16 days to update anyone on the second23. The company moved fast the first time. It slowed down the second time, the time it needed speed most.
Bloomberg Law quoted a Fireworks AI spokesperson. The company was "actively working with our customers to manage the incident, including Notion, Cursor and others," the spokesperson said7. That sentence names the customers under pressure. It leaves out why the second warning took five times as long as the first.
What to do
Ask any AI vendor how long its last incident took to reach your inbox. Speed matters as much as the breach itself. Fireworks can point to three days for its first one and 16 for its second. The gap between those two numbers tells you more than either one alone.
Build an exit plan before you need one. Chips can be scarce, and moving away after a breach can take months. Test a backup provider during a calm week.
Rotate every credential a vendor like Fireworks has ever touched the moment you learn of any breach there, first or second.
By the numbers
- $17.5 billion: Fireworks AI's valuation, set in its Series D round this July3.
- 18 days separated Fireworks' first breach, caught Oct. 6, from the start of its second, Oct. 243.
- Three days passed before Fireworks told the public about its first breach2.
- Sixteen days passed before Fireworks updated the public on the second23.
- Over 10,000 customers: how many Fireworks says it serves, by its own count3.
- Fewer than 1 percent: the share of Notion's workspaces the breach reached1.
What to watch
Watch whether Harvey or any other wavering customer actually leaves, rather than just reportedly weighing it. Fireworks' next bulletin deserves a close look too. Two break-ins would become a pattern the moment a third one lands. A fresh security pledge to investors, tied to Wehner's arrival, would show the usual reassurances stopped working.
Sources
- Notion, "Security incident involving a third-party AI vendor," Notion, Nov. 9, 2026, https://www.notion.com/help/security-incident-involving-a-third-party-ai-vendor
- Fireworks AI, "Update on October 2026 security incident," Fireworks AI, Nov. 9, 2026, https://fireworks.ai/security/bulletins/october-2026-security-incident-update
- Gennaro Cuofano, "$17.5B Fireworks AI Hacked Again 18 Days After First Breach," FourWeekMBA, Nov. 9, 2026, https://fourweekmba.com/ai-17-5b-fireworks-ai-hacked-again-18-days-after-first-breach/
- Jason Lemkin, post on X, Nov. 9, 2026, https://x.com/jasonlk/status/2119907305613639770
- Ron Patel, "GPU scarcity, not security, keeps Fireworks AI customers after the hack," Startup Fortune, Nov. 9, 2026, https://startupfortune.com/gpu-scarcity-not-security-keeps-fireworks-ai-customers-after-the-hack/
- BleepingComputer, "Fireworks AI discloses new breach after cloud provider hack," BleepingComputer, Nov. 9, 2026, https://www.bleepingcomputer.com/news/security/fireworks-ai-discloses-new-breach-after-cloud-provider-hack/
- Bloomberg Law, "Nvidia-Backed Fireworks AI Discloses Its Second Hack in Weeks," Bloomberg Law, Nov. 9, 2026, https://news.bloomberglaw.com/business-and-practice/nvidia-backed-fireworks-ai-discloses-its-second-hack-in-weeks
- Hacker News, "Fireworks AI security breach impacts Notion and their customers," Hacker News, Nov. 10, 2026, https://news.ycombinator.com/item?id=50437106
- Natasha Mascarenhas, post on X, Nov. 9, 2026, https://x.com/nmasc_/status/2119895816508944889
