Fireworks says the evidence indicates links to a financially motivated cybercriminal threat actor group aimed at selling tokens from unauthorized access to Large Language Models to illicit routing gateways, known as LLMJacking.

The exact words it rests on

The evidence indicates links to a cybercriminal threat actor group, which is financially motivated and aimed at selling tokens from unauthorized access to Large Language Models (LLMs) to illicit routing gateways, known as "LLMJacking".

What the source said when we opened it, on 13 Nov 2026.

The source

Update on October 2026 security incident (Fireworks bulletin, last updated 9 November 2026)
Fireworks AI · 2026-11-09

Open the sourcearchived copy

Checked

Checked by the notis newsroom on 13 Nov 2026, against the source above.

In the story

Notion says Fireworks AI breach affected under 1% of its workspaces 13 Nov 2026