However, that protection does not apply uniformly across every Fireworks service. Certain features, including batch processing, stored responses and training-related operations, can retain customer content. The compromised systems contained data outside the company's default zero-retention processing environment.
Fireworks disclosed additional details in a November 9 security update, stating that it had found no evidence of an impact on its Inference, Training SDK and Nexus services, which generally operate under zero data retention policies. CEO Lin Qiao separately clarified that the unaffected inference services did not include batch inference, a feature designed to process large volumes of requests asynchronously.
The company acknowledged that attackers accessed portions of its storage infrastructure, resulting in the exposure of additional customer information. The compromised data included billing records and certain customer datasets, although Fireworks has not provided a complete public accounting of every affected customer.
Among the organizations impacted was Notion, the productivity software company that uses Fireworks to support features within Notion AI. The incident exposed conversation records associated with Insights, a feature that helps customers understand how AI is being used within their workspaces.
Notion explained that Fireworks handled classification tasks supporting Insights. During its investigation, the company discovered that information processed through that arrangement included transcripts of conversations between users and Notion AI.
Those records could contain both questions submitted by users and responses generated by the AI assistant. Depending on what individuals entered into their conversations, the exposed material could include internal business information, customer details or other sensitive content.
Notion estimates that fewer than 1% of its workspaces may have been affected. It also emphasized that most of the exposed transcripts could not be linked to specific workspaces, limiting the ability to identify which customers were associated with individual conversations.
Despite that uncertainty, Notion advised affected customers to assume the information had been compromised. Its security notice states, “We recommend that you treat this data as if it were exposed.”
The company took steps to separate its systems from Fireworks before the full scope of the additional exposure was confirmed. On November 3, Notion disconnected its integration with the provider, removed data held within its systems and ended connectivity between the two companies.
Fireworks subsequently notified Notion on November 8 about an additional dataset identified during the investigation. Analysis of that information revealed the Notion AI chat transcripts associated with Insights.
The incident originated with a security compromise involving an outside cloud infrastructure provider that hosted Fireworks research and development machines. According to Fireworks, the cloud provider experienced an intrusion on October 23, which attackers used the following day to reach Fireworks' development environment.
Once inside, the attackers executed an unauthorized workload that enabled access to additional customer information. The incident followed an earlier security breach affecting Fireworks in October, making it the company's second reported compromise in consecutive months.
Fireworks believes the attackers were primarily motivated by financial gain through unauthorized access to large language models. The company linked the activity to a practice known as LLMJacking, in which compromised access credentials or computing resources are used to obtain AI model services and sell that access through unauthorized channels.
Google Threat Intelligence Group and Mandiant discussed the growing use of this technique in a November 2 report examining how attackers monetize access to cloud-based AI models.
Although the suspected objective involved unauthorized model usage, the intrusion also exposed customer information stored within the affected Fireworks environment. That secondary impact extended the consequences of the attack to businesses whose own products depended on the provider.
Fireworks serves more than 10,000 customers, according to The Record, and its customer base includes companies such as Cursor and legal technology provider Harvey. The available disclosures do not establish that those companies were affected by the breach.
The incident highlights an important limitation of zero data retention policies. A provider may avoid storing information during standard inference requests while maintaining separate systems that retain customer content for other functions. Those stored datasets can remain vulnerable even when the primary AI processing infrastructure is unaffected.
For organizations integrating external AI models into their applications, the relevant security questions therefore extend beyond whether a vendor retains ordinary prompts. They also include which supporting services store information, how long those records remain available and whether data is transferred into other processing environments.
Notion's experience illustrates how that distinction can affect customers who may have no direct relationship with the underlying AI infrastructure provider. Information submitted through a familiar workplace application can pass through external systems that perform specialized tasks, creating additional points where sensitive material may be stored.
Fireworks maintains that its principal zero-retention services were not affected by the intrusion, while acknowledging that attackers reached other storage systems containing customer data. Notion has confirmed a limited but potentially sensitive exposure involving AI chat transcripts and has disconnected its services from the provider.
The disclosures leave the broader impact on Fireworks' customer base unresolved, but they establish that zero data retention for routine AI requests does not necessarily mean customer information is absent from every system operated by an AI vendor.
This analysis is based on reporting from Venture Beat.
Image courtesy of Bleeping Computer.
This article was generated with AI assistance and reviewed for accuracy and quality.
