The latest cybersecurity incident involving Fireworks AI highlights an important challenge for enterprises adopting artificial intelligence: protecting AI applications is not enough if the infrastructure supporting them remains vulnerable.

Fireworks AI has disclosed another security breach, just weeks after an earlier incident involving the exposure of API keys and authentication tokens. In the latest attack, cybercriminals reportedly compromised a third-party cloud provider and used that access to reach Fireworks development machines.

The attackers gained access to customer account metadata, billing information and, for certain customers, portions of incomplete AI models and datasets.

What makes this incident particularly concerning is that the initial compromise occurred outside Fireworks' own infrastructure, through a trusted cloud service provider.

For enterprises, this raises an important question: Do organisations have sufficient visibility and control over the security of the third-party platforms handling their AI models, proprietary datasets and sensitive credentials?

As businesses increasingly integrate AI into their operations, they are creating new dependencies involving cloud infrastructure, model providers, APIs, development environments and external services.

A compromise at any one of these layers can potentially expose sensitive business information, intellectual property and authentication credentials.

The incident also highlights the growing threat of LLMjacking, where attackers steal access credentials to use AI services without authorisation or resell that access through illicit channels.

This reinforces the importance of Zero Trust architecture, continuous identity verification, API security, behavioural anomaly detection, Data Loss Prevention and strict access controls across cloud environments.

Organisations must also ensure that development systems are appropriately isolated from production environments, sensitive credentials are securely managed, and unusual API activity or data transfers are continuously monitored.

Equally important is recognising that third-party security assessments cannot be treated as a one-time exercise. Trust must be continuously evaluated as infrastructure, applications and business dependencies evolve.

The larger cybersecurity lesson is that enterprise AI security must extend beyond the AI application itself to every system, service provider and identity supporting it.

Because when an organisation entrusts its data and AI models to an external platform, the security of that platform becomes an extension of its own security perimeter.

AI infrastructure startup Fireworks has disclosed a new security breach in which attackers accessed its development machines after breaching a third-party cloud provider. [...]

Source: Fireworks AI discloses new breach after cloud provider hack via Bleeping Computer — published 10 Nov 2026.