Poisoned Pipeline / Incidents / AS346
Internal Fireworks credentials let a third party read secrets stored in customer evaluation jobs
AI platform / inference provider
On 6 October 2026 Fireworks identified a security incident involving
unauthorised use of internal Fireworks credentials. A third party
accessed environment variables used in evaluation jobs in a limited
number of customer accounts. In its bulletin, last updated on
10 October, the company says it found no evidence of unauthorised
access to customer models, datasets, training data, personal
information or inference traffic inside its perimeter, and that it
does not store prompts or outputs by default.
Containment began the same day. Affected customers were notified from
7 October; employee API keys were rotated on 9 October; the bulletin
was published that evening. On 10 October Fireworks revoked further
Fireworks user API keys and service-account tokens found in a
completed credential review, and says the review and rotation are
continuing. It also revoked the internal credentials used in the
incident, the affected Fireworks API keys, and keys it identified as
created by the actor, added access restrictions, and is reviewing how
secrets are made available to evaluation jobs. Customers are told to
replace revoked keys, rotate or revoke third-party credentials named
in their notice with the issuing providers - because removing a stored
secret does not invalidate the credential behind it - to review those
providers' access logs and data, and to check for unrecognised
resources.
The bulletin does not say how the internal credentials were obtained,
which evaluation-job service held the variables, or how many accounts
were affected. Wiz's 30 October roundup lists Fireworks as the
earliest of at least nine AI developer platforms breached that month,
alongside Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp,
CommandCode and Northflank, and notes that no single vulnerability or
dependency has been established across them.
Mapped techniques
supply-chain Fireworks evaluation jobs
Internal Fireworks credentials were used without authorisation
to reach environment variables belonging to customer accounts.
How those internal credentials were obtained is unpublished.
The access was to environment variables in evaluation jobs,
which hold API keys and tokens stored as secrets. The review
also found keys created by the actor and service-account
tokens, which were revoked.
post-supply-chain Customer credentials held by Fireworks
Exposed values include third-party API keys and tokens stored
in affected accounts. Fireworks tells customers to revoke them
with the issuing providers, since deleting the stored secret
leaves the underlying credential valid.
Framework gaps noted
- The route to the internal Fireworks credentials is unpublished, so the entry point is not mapped as a vulnerable product, a poisoned dependency or phishing.
- The evaluation-job service that exposed the variables and the number of affected accounts are not named.
- Not merged with the other October platform breaches: Fireworks, Zeabur and Lightning attribute root cause to credential access, but no shared vulnerability or dependency has been established.