AI news Oct 11, 2026

Today · event date October 10

Fireworks revokes misused credentials; probe is still open

Lin Qiao, CEO of inference platform Fireworks AI, discloses misuse of internal credentials; the company has revoked them and notified affected customers

Why this matters to you: If your team runs on Fireworks, first check whether you got a notice, then check that you can rotate your keys at any time.

Fireworks AI hosts open-weight models and runs them for companies that call them through its API. On October 10, CEO Lin Qiao wrote on X: "We identified a security incident involving unauthorized use of internal Fireworks credentials." She says the company has contained the incident, revoked those credentials, directly notified every customer confirmed to be affected, and is investigating with a security firm; so far, she writes, they "have not detected impact or access to customer data or inference traffic." Inference traffic is the requests customers send to a model and the answers the model sends back (Lin Qiao, 2026-10-10). The post describes them only as Fireworks' internal credentials. It doesn't say what kind they were, whether customers' own keys were involved, how they were obtained or what they were used for; for what the company's security notice says, see Verification below.

Verification: We read Lin Qiao's post itself; we read the security notice it links to only after publication (see the correction at the top of this page). The notice says "On October 6, Fireworks identified a security incident," and "We believe that environment variables, including API keys and tokens stored as secrets, were captured in certain affected accounts." Its timeline records that on October 10 the company revoked additional Fireworks user API keys and rotated service-account tokens, and it asks affected customers to rotate the third-party credentials named in their notice; it was last updated on October 10 (Fireworks security notice, updated 2026-10-10). Neither the post nor the notice gives a count of affected customers. "Not detected" is the state of an investigation still under way, not a finding. The only source is the company itself, so we aren't forming a new judgment today. When the investigation reports, the thing to check is whether the line "no impact on customer data" gets revised. Teams on other hosted-inference services can put the same two questions to their own provider: if its internal credentials were misused, would it notify customers directly, and can customers rotate their keys at any time?