Fireworks AI Internal Credential Compromise Exposes Customer API Keys and Tokens

Fireworks AI disclosed a security incident involving unauthorized use of internal Fireworks credentials. The attacker accessed environment variables associated with evaluation jobs in a limited number of customer accounts, including API keys and tokens stored as secrets.

Fireworks detected unauthorized activity on October 6, 2026. Its investigation found that compromised internal credentials were used to access environment variables in customer evaluation jobs. Fireworks revoked the affected credentials, rotated employee API keys, restricted access, notified impacted customers, and advised customers to rotate exposed third-party secrets.

AI Relevance
The incident directly affected an AI inference and evaluation platform. Customer secrets stored inside AI evaluation workflows became accessible through compromised internal credentials, demonstrating how AI infrastructure can create cross-customer exposure paths even when underlying models and datasets are not compromised.

Fireworks AI evaluation jobs, customer environment variables, Fireworks API keys, and third-party API credentials stored as secrets.

Compromised Internal Credentials / Customer Secret Exposure

Exposed API keys and tokens could potentially provide access to customer cloud services, developer platforms, or third-party resources depending on the privileges attached to each secret. Fireworks stated that it found no evidence of access to models, datasets, training data, or live inference traffic.