Fireworks AI: October 2026 security incident bulletin

Evidence record

Fireworks incident notice, updated October 10, distinguishes evaluation-environment credential exposure from currently unsubstantiated access to other customer data and records credential rotations.

Read the original source ↗

Claim-level citations (4)

• supportsFireworks evaluation-job secrets were exposed through compromised internal credentials: On October 10 Fireworks revoked additional user API keys and rotated service-account tokens after a credential review; its investigation continued.

  What we know timeline, October 10 row

• supportsFireworks evaluation-job secrets were exposed through compromised internal credentials: On October 6, Fireworks detected unauthorized use of internal credentials to access evaluation-job environment variables in a limited number of customer accounts.

  Opening incident description and Who is affected?

• supportsFireworks evaluation-job secrets were exposed through compromised internal credentials: Fireworks instructs affected customers to rotate or revoke third-party secrets with the original issuer; deleting a secret from Fireworks does not invalidate the credential at that external provider.

  What affected customers should do, Rotate third-party credentials identified in your notice

• supportsFireworks evaluation-job secrets were exposed through compromised internal credentials: In its October 10 bulletin, Fireworks said it believes stored API keys and tokens were captured in certain affected accounts while reporting no detected evidence of unauthorized access to customer model assets, inference traffic or personal information within its control.

  What was affected? section