Let’s talk about the AI company that told ten thousand businesses nothing was taken — and then sent the email a month later.
Fireworks AI is not a famous name. You’ve probably used something it built. It’s the layer where companies take their own data and turn it into a model that behaves like them. Uber, Shopify, DoorDash, Upwork, Cursor, Cognition. Roughly ten thousand business customers.
On the ninth of October it published a security bulletin. Someone had used internal Fireworks credentials to read environment variables inside customer evaluation jobs. And the bulletin said this, more or less: we have found no evidence of unauthorised access to customer models, datasets, training data, personal information, or inference traffic.
Read that again. Everything that matters, untouched.
Then on the ninth of November, one month to the day, it published an update.
Account and billing information. And for a limited set of accounts — secrets, datasets, and incomplete model weights.
Picture the business on the other end of that email.
Not a tech company. Say a thirty-person industrial supplier in Germiston. Six years of quotes, site visits, angry emails, the way the senior guy talks a nervous client down from a bad delivery date. All of it typed into a fine-tuning job last March. Now the model answers the first-line questions the way they answer them, and the senior guy only touches the hard ones. It took a year to build and it is the actual edge.
Then someone tells you part of a weight file left the building, and the same person told you a month ago that nothing had.
Sit in that for a second, because the obvious question is the wrong one. The obvious question is: how much did they get?
Here’s the better question. How would you know?
A database you can inventory. A spreadsheet you can list row by row. But weights are a file of numbers, and the file is the model. There is no original. A copy and the thing itself are the same object. Which means three things fall over at once.
You can’t prove which copy is yours. You can’t revoke a file. And you can’t look at a model running somewhere in the world and say, with evidence, that it’s yours.
So the theft of a model is not a detectable event.
That’s not a Fireworks problem. That’s everyone’s problem, and Fireworks just showed us the shape of it.
Now, the facts, because they matter and they’re worse than a headline.
The October sixth intrusion was detected and contained. Notifications went out on the seventh. Keys rotated. Then on the twenty-third, a third-party cloud provider hosting Fireworks’ research and development machines had its own incident. On the twenty-fourth, the intruder used that as a road in, reached Fireworks development machines, and ran an unauthorised workload. That’s where the additional customer data impact came from. Their own line is that they detected it the same day and closed the critical holes.
And the reason for all of it is almost banal. Google Threat Intelligence and Mandiant published research on the second of November describing the market: stolen model access resold through illicit routing gateways, LLM mixers, subscribers buying tokens that someone else is paying for. In individual incidents Mandiant has seen fraudulent consumption pass a hundred thousand dollars in a single day, and a million cumulative at some organisations before access got pulled.
This isn’t espionage. It’s a resale business with a supply chain.
And it isn’t one company. In the same October window: OpenCode disclosed that keys for OpenAI, Anthropic and Google saved by about one point four percent of its Console users had been reached through a legacy system being decommissioned. Railway disclosed that customer environment variables may have been read, some decrypted, and called it a series of attacks on platform companies. And a malicious release of LiteLLM, version 1.107.0, went out on PyPI and Docker and harvested cloud credentials and model keys from anyone who installed it.
Nobody has proven these were one actor. Fine. But look at what they have in common, because that’s the part that survives the argument about attribution.
Every one of them is a middle layer. A host. A console. An evaluation service. A gateway. A package. None of them is the model. All of them hold the keys to the model.
We built the AI stack the way we built the web stack — plug things together fast, let each layer hold a credential so it can do its job — and then we acted surprised that the layer with everyone’s keys got hit.
What people are missing is quieter than any of that.
First: “incomplete model weights” is doing a lot of work in that sentence, and it should frighten you more than “full weights” would. Half a fine-tuned model plus your dataset is not half a leak. The adaptation is the valuable part. Whoever holds a partial checkpoint and a slice of your data can finish the job somewhere else, and you will never see it happen.
Second: the comfort clause you were sold is not the protection you think it is. Fireworks is zero data retention by default on inference and on its training SDK. Prompts aren’t logged. Outputs aren’t stored. Good, genuinely. But zero retention of prompts says nothing about the artifact you built with them. Your prompts were never the asset. Your weights were. The industry spent three years teaching you to ask “do you train on my data?” and almost nobody taught you to ask “where does my finished model physically live, who can copy it, and can I prove it’s mine?”
Third, and this is the operational one. “We found no evidence” is not a clearance. It’s a status report on a search that isn’t finished. On the sixth of October they had no evidence because they hadn’t looked in the places the intruder hadn’t reached yet. A month later they had evidence. Nothing about the world changed in that month except the investigation. When your vendor tells you no evidence, the correct translation is: not yet.
So what do you actually do. Five things, and none of them are glamorous.
Know where your artifacts live. Not “in the cloud”. Which vendor, which region, which bucket, which account, and whether the file is a checkpoint, a merged model, or an adapter. Write it down somewhere that isn’t the vendor’s console.
Sign and hash what you build. Every checkpoint, every dataset version, the config, the seed, the eval scores. It’s cheap. It turns “a model that looks like ours” into “this file is ours, and here’s the digest”. You cannot defend an asset you can’t identify.
Keep the recipe, not just the cake. Your data, your ordering, your eval set, your reasons. If the weights walk, you rebuild. If the recipe walks with them, you don’t.
Give every credential a short life and a small job. Spend caps. One key per purpose. The reason this market exists at all is that a stolen key is worth money for weeks. Make it worth money for twenty minutes.
And test the call. Once a quarter, ask your vendor, in writing: if a weight file left your building, how would either of us know? If the answer is a pause, you’ve learned more from the pause than from the answer.
There’s an irony sitting on top of this that I can’t leave alone. Fireworks sells sovereign deployment. That’s the pitch — run your model on your terms, close to your data, under your control. It’s a good pitch. It’s also the exact thing this incident demonstrates is not a feature you buy, but a set of keys you hold.
You can rent the machine. You cannot rent the proof.
Here’s the principle, and it’s older than any of this. Every institution humans ever built for trust rested on the ability to identify a thing and say where it came from. A deed. A serial number. A signed invoice. A wax seal. We understood, for about four thousand years, that a thing you cannot identify is a thing you cannot defend, and a thing you cannot defend will eventually be taken.
We just built the most valuable artifacts in the economy and shipped them without birth certificates.
So the right that has to survive is not the right to be told about a breach. It’s the right to prove which artifact is yours — before, during, and after someone else has a copy.
If you run a business and you’ve fine-tuned something, go and find out where that file is tonight. Not next quarter. Tonight.
You’ve got this. Mostly because nobody else is going to do it for you.