Fireworks says internal credentials were abused, leading to customer key exposure

Fireworks discovered a security incident on October 6, where an unauthorized third party abused internal credentials to access environment variables used in evaluation jobs in a small number of customer accounts. The company states that currently there is no evidence of unauthorized access to customer models, datasets, training data, inference traffic, or personal information, and states that the platform does not store prompts and outputs by default. Fireworks initiated containment on the same day, rotated employee API keys on October 9 and notified affected customers, revoked additional user API keys and rotated service account tokens on October 10, and stated that credential review and rotation are ongoing. Affected customers need to replace revoked API keys and rotate third-party credentials at the issuing party.