> ## Content Index > Fetch the complete content index at: https://unhyd.com/llms.txt > Use this file to discover other available public pages before exploring further. # Fireworks Security Incident Prompts New Credential Rotation - URL: https://unhyd.com/article/fireworks-security-incident-prompts-new-credential-rotation/ - Published: 2026-10-12T01:38:15.000Z - Updated: 2026-10-12T01:38:15.000Z - Description: Fireworks says it expanded key and token rotations after an incident exposed secrets in some customer evaluation jobs. Here is what the update confirms. - Author: Jonas Muthoni - Tags: #home-featured-top, Technology Fireworks says it has revoked additional user API keys and rotated service-account tokens after a security incident exposed secrets stored in environment variables for evaluation jobs in a limited number of customer accounts. The October 10 update is the latest material development in an incident the company says it identified on October 6. In its [active security bulletin](https://fireworks.ai/security/bulletins/october-2026-security-incident?ref=unhyd.com), Fireworks says an unauthorized third party used internal Fireworks credentials to access those environment variables. The company says it has not detected evidence of unauthorized access, within its security perimeter or control, to customer models, datasets, training data, personal information, or inference traffic. Its investigation and credential review are continuing. ## What changed in the latest Fireworks security incident update The central news is not the initial discovery on October 6\. It is the remediation action Fireworks recorded for October 10: additional Fireworks user API keys were revoked and service-account tokens identified during a completed credential review were rotated. The company says further review and rotation are still under way. Its published timeline says Fireworks began containment when it identified the activity on October 6, started notifying affected customers on October 7, rotated employee API keys on October 9, and published the bulletin later that day. The October 10 work broadens that response from the first set of internal and affected keys to further credentials found through review. That distinction matters for customers and for readers following the incident. A security notice is most useful when it identifies what changed after the initial disclosure: what was found, what access was removed, and what questions remain open. Fireworks has provided a timeline and a description of its current actions, but it has not publicly named the third party or disclosed the number of affected accounts. ## What the company has and has not confirmed Fireworks says the accessed variables included API keys and tokens stored as secrets in certain affected accounts. It says every identified affected customer received a direct notification that identifies credentials requiring action. The company also says it is working with a cybersecurity expert firm and monitoring for further activity. Those statements should be read as the company’s current assessment, not as an independent forensic conclusion. Fireworks says it has not detected unauthorized access to models, datasets, training data, prompts and outputs, personal information, or inference traffic. It also says it is reviewing calls made with exposed credentials and continuing to assess other potential access. The absence of detected evidence is an important scope statement, but it is not the same as a final declaration that no other access occurred. ## Why evaluation-job secrets deserve attention Environment variables are a common way to pass configuration and credentials to a running job. In an AI evaluation workflow, they can make it possible for a job to call a model API, retrieve a service, or connect to another system without placing a credential directly in code. That convenience creates a clear operational requirement: a credential exposed in a job environment may need action at the service that issued it, not merely removal from the job configuration. Fireworks makes that point directly in its customer guidance. Affected customers are being asked to replace revoked Fireworks keys, rotate or revoke identified third-party credentials with their issuing providers, review activity and data associated with those credentials, and check for unrecognized API keys, users, evaluators, training jobs, or datasets. An application using a revoked Fireworks key will fail authentication until it is updated. ## What this means for AI platform buyers The incident is a reminder that an AI deployment’s security boundary is wider than a model or a prompt. Evaluation, training, retrieval, and operational tooling can each hold credentials that reach other services. For security leaders, the practical question is whether their teams can quickly inventory those credentials, identify their owners, rotate them without losing track of dependent applications, and review the resulting access logs. That is consistent with [CISA’s Secure by Design guidance](https://www.cisa.gov/securebydesign?ref=unhyd.com), which argues that technology providers should treat customer security as a core business requirement rather than a bolt-on feature. In this case, readers should watch for Fireworks to publish the additional remediation measures it says it is reviewing for how secrets are made available to evaluation jobs. ## What happens next Fireworks says customers that did not receive a notice do not currently need to take incident-specific action, based on its investigation to date. Customers that did receive one have a more immediate task: rotate the identified credentials at both Fireworks and any third-party provider, update dependent applications, and examine access or activity associated with those secrets. The company’s bulletin remains active. The next meaningful update would be a revised scope, new findings from its credential review, or verified changes to the controls that govern secrets in evaluation jobs. Until then, the most defensible account is the narrow one: Fireworks has disclosed unauthorized access to secrets in some customer evaluation jobs, expanded its revocation and rotation work on October 10, and continues to investigate.