Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In October 2026, Fireworks AI disclosed a multi-stage breach in which financially motivated threat actors stole internal credentials and leveraged a compromised third-party cloud provider to pivot into Fireworks development machines. First detected on October 6, the attack expanded on October 23–24 when attackers ran unauthorized workloads that exposed customer billing addresses, invoice and payment history, resource metadata, and a subset of incomplete model weights and datasets. The incident is attributed to a cybercriminal group conducting LLMjacking — stealing LLM access tokens to resell inference capacity on illicit routing gateways at the legitimate customer's expense.

This breach reflects a rapidly maturing threat class targeting AI infrastructure providers. As enterprise adoption of LLM platforms accelerates, attackers are pivoting from traditional data theft toward credential-based AI resource hijacking. Google issued a concurrent warning about LLMjacking campaigns spanning financial services, retail, and technology sectors globally, signaling that AI supply-chain compromise is now a mainstream criminal business model.

Why This Matters Now

LLMjacking has emerged as a scalable criminal enterprise in 2026, with threat actors systematically targeting AI infrastructure providers to resell stolen inference access. As organizations embed LLMs into production workflows, compromised AI credentials translate directly into financial liability, proprietary model exposure, and downstream supply-chain risk — making cloud credential hygiene and east-west segmentation urgent priorities for any enterprise consuming or hosting AI services.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

LLMjacking is a technique where attackers steal cloud credentials to gain unauthorized access to large language model inference capacity, then resell that access on illicit gateways. In the Fireworks AI breach, attackers used stolen internal credentials to run unauthorized workloads and exfiltrate API tokens, billing data, and partial model weights.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this incident because the attacker's entire attack chain depended on unrestricted cross-environment reachability — from a third-party cloud provider into Fireworks development infrastructure. By enforcing identity-aware segmentation and controlled egress across cloud boundaries, CNSF would likely have constrained the attacker's ability to pivot laterally, operate unauthorized workloads, and exfiltrate sensitive assets at scale.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: CNSF fabric-level visibility across the third-party hosted environment and Fireworks cloud boundaries would likely reduce the attacker's ability to operate undetected using harvested credentials, as anomalous workload behavior and unauthorized identity usage patterns would surface against established baselines more quickly than in an unmonitored multi-tenant environment.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation enforced at the workload and identity level would likely reduce the privilege scope available to compromised service account tokens, as access paths between the third-party cloud environment and Fireworks development infrastructure would be constrained by explicit policy rather than inherited trust from shared identity planes.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic security controls enforced between the third-party cloud environment and Fireworks development segments would likely constrain the attacker's ability to move freely across that cloud boundary, reducing reachability to internal data stores and limiting how many development-tier systems could be accessed from a single compromised identity or workload.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility and control spanning the Fireworks development environment would likely surface the unauthorized workload's anomalous API call patterns and unexpected data enumeration behavior, reducing the attacker's ability to maintain persistent, low-noise command orchestration while blending into legitimate cloud traffic over an extended dwell period.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security and policy enforcement on outbound traffic from Fireworks development workloads would likely constrain the attacker's ability to transfer bulk data — including billing records, model weights, and API secrets — to external destinations, reducing the volume and completeness of what could be successfully exfiltrated during the operational window.

Impact (Mitigations)

Had prior CNSF controls constrained lateral movement and egress at earlier stages, the pool of exfiltrated assets reaching illicit LLMjacking gateways would likely have been smaller — reducing the number of compromised customer tokens available for resale and limiting the financial and reputational blast radius across the affected customer base.

Impact at a Glance

Affected Business Functions

  • AI Model Hosting and Inference Services
  • Customer Billing and Payment Processing
  • Research and Development (R&D) Model Training Pipelines
  • API Key and Secrets Management
Operational Disruption

Estimated downtime: 19 days

Financial Impact

Estimated loss: N/A

Data Exposure

Exposed data included resource metadata (Fireworks resource identifiers, display names, descriptions, creation timestamps), billing and shipping addresses, invoice and payment history, account balances, and credit usage for a limited set of customer accounts. Additionally, a subset of incomplete model weights and proprietary datasets belonging to certain customers was accessed. Environment variables containing API keys and tokens were captured in the initial phase of the breach. Payment card numbers were confirmed not stored by Fireworks and were not impacted. The breach also facilitated LLMjacking activity, where stolen credentials were leveraged to route unauthorized LLM inference workloads through illicit gateways, exposing customers to potential unauthorized API usage charges. The financial loss estimate is recorded as 0 due to no publicly disclosed quantified figure; however, the exposure of proprietary AI model weights and customer billing data represents significant potential downstream financial and competitive harm to affected customers.

Recommended Actions

  • • Enforce Zero Trust Segmentation between third-party and internal environments: Apply identity-based microsegmentation (ZTMM.Network, NIST.800-53.AC-6) to enforce least-privilege trust boundaries between third-party hosted R&D machines and internal Fireworks development infrastructure — preventing the cross-environment lateral pivot that enabled this breach.
  • • Deploy East-West Traffic Security controls to detect and block internal pivoting: Instrument workload-to-workload and service-to-service traffic flows with inline east-west inspection (ZTMM.Data, NIST.800-53.SC-7) to detect unauthorized API calls and anomalous inter-region movements between cloud-hosted R&D environments and production development machines.
  • • Implement Egress Security and Policy Enforcement to block unauthorized data exfiltration: Deploy FQDN-based egress filtering and outbound traffic policy enforcement (ZTMM.CrossCutting.Governance, NIST.800-53.SC-18, NIST.CSF.PR.DS-5) to prevent exfiltration of model weights, billing data, and API secrets to unauthorized external destinations or illicit LLMjacking routing gateways.
  • • Enable Multicloud Visibility and Control to surface anomalous unauthorized workloads: Centralize traffic observability and control plane telemetry across hybrid and third-party cloud environments (ZTMM.CrossCutting.Visibility, NIST.800-53.AU-6) to detect anomalous workload execution, repeated unauthorized API access patterns, and suspicious automation consistent with LLMjacking credential abuse before significant data is harvested.
  • • Apply Cloud Native Security Fabric (CNSF) inline enforcement to protect AI infrastructure access patterns: Extend cloud-native inline policy enforcement and real-time inspection to AI inference and training job environments (ZTMM.CrossCutting.Automation, NIST.800-53.SI-4) to detect prompt injection, unauthorized model access, shadow AI consumption, and stolen token reuse — directly countering LLMjacking TTPs targeting LLM infrastructure credential environments.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image