Fireworks AI disclosed on Monday that its investigation into a security incident first flagged on October 6, 2026 uncovered further malicious activity beyond the API keys and tokens initially reported.

On October 24, an unauthorized third party reached Fireworks development machines through an unnamed third-party cloud provider hosting its R&D systems and ran an unauthorized workload, extending impact to account and billing information, resource metadata, and a subset of incomplete model weights and datasets for a limited set of accounts.

The company says it detected no further successful unauthorized access after October 25.

The escalation is striking because Fireworks' October 10 notice stated there were no signs that customer models, datasets, training data, inference traffic or personal information had been accessed.

That assessment has now been reversed: billing and shipping addresses, invoice and payment history, account balances, credit usage, and incomplete model weights are all confirmed affected.

Fireworks says payment card numbers are not stored by the company and were untouched, and that it is alerting impacted customers directly.

Notion confirmed the incident exposed Notion AI chat transcripts used for its Insights feature across fewer than 1% of customer workspaces.

According to CyberSecurityNews, Fireworks first alerted Notion on November 2 with an apparent synthetic-data-only exposure; Notion cut its Fireworks connection the next day, then learned on November 6 that customer data might be involved, with confirmation on November 8.

Most transcripts were unattributable — unlabeled by author or workspace and without tool call results — but chat text itself could still contain sensitive details. Notion has disabled Insights and stopped serving open-weight models through Fireworks.

Fireworks said the evidence points to a financially motivated cybercriminal group that sells stolen access tokens for large language models to illicit routing gateways — an emerging pattern known as LLMjacking, where victims' AI infrastructure is hijacked and the legitimate owner pays the compute bill.

The incident follows a Google warning, cited by The Hacker News, that threat actors are increasingly targeting AI infrastructure for LLMjacking across North America, South America and Asia Pacific in financial services, retail, technology and transportation.

Fireworks says it has revoked and rotated compromised internal credentials and service account tokens, isolated affected systems to block lateral movement, tightened access controls and improved logging and monitoring.

Notion recommends that affected customers immediately rotate any passwords, API keys or other credentials pasted into Notion AI during the attack window, and says it will contact additional customers if its ongoing investigation finds further exposure.

Singapore readers should also note a separate incident: SPH Media confirmed attacks on five of its systems affecting 9% of its database, exposing email addresses and some names, mailing addresses and phone numbers, with no payment or banking data compromised, per Marketing-Interactive.