Intel / article

Fireworks discloses October 2026 breach of evaluation-job secrets

Source: x.com
Author: Fireworks
Date: Published Oct 10, 2026

Why it matters

If you run evaluation jobs on Fireworks, secrets stored as environment variables may have been captured. Deleting a stored secret does not invalidate the underlying credential, so rotate it with the issuing provider.

Key takeaways · AI-distilled

Fireworks says an outside party used internal Fireworks credentials and captured environment variables, including API keys and stored as secrets, in a limited number of customer accounts' jobs.
Fireworks reports no evidence that traffic was accessed and notes it does not store prompts or outputs by default. Whether models, datasets and training data were touched is still being checked against calls made with the exposed credentials.
Per Fireworks' timeline (PDT), it spotted the activity at 9am on Oct 6, began notifying customers Oct 7, rotated all employee API keys on Oct 9 at 4pm and published the bulletin that night.
Fireworks warns that deleting a stored secret does not invalidate the underlying credential. It revoked the exposed Fireworks keys and keys the actor created, but third-party credentials must be rotated with the providers that issued them.
Affected customers are asked to look for unrecognized API keys, users, evaluators, training jobs and datasets. Fireworks offers secret names and credential fingerprints over a secure channel, and says accounts without a notice need no action for now.

Terms in this piece · Glossary

eval — A repeatable test for AI quality — a set of tasks plus scoring — used the way software teams use test suites, because model output is too variable to judge by eyeballing.
inference — Running a trained model to get answers — the phase where AI is actually used, as opposed to trained.
token — The chunk of text a model reads and writes in — roughly three-quarters of a word — and the unit AI usage is billed in.

Read the source x.com