Fireworks AI Confirms Wider Breach; SGLang RCE Hits NEAR AI

· Cybersecurity · United States

AI infrastructure startup Fireworks AI disclosed a new breach in which attackers accessed its development machines after breaching a third-party cloud provider. Its investigation into an incident first reported in early October uncovered further malicious activity affecting account and billing information, along with secrets, datasets and incomplete models for a limited set of accounts, the company said. Separately, an attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, running code on a NEAR AI inference server and potentially viewing requests processed that day, including those sent in confidential mode; the intrusion reportedly stole data from 18 agents and about 100 users. The incidents underline the exposure of AI platforms holding model weights and customer data.

Why it matters：AI service providers are becoming high-value targets because they hold model weights, training data and confidential user prompts, and a single flaw can expose many downstream customers.

Key points

  • Fireworks AI said account, billing, secrets, datasets and incomplete models were affected for a limited set of accounts.
  • The breach followed compromise of a third-party cloud provider and reached development machines.
  • The SGLang flaw let an attacker run code on a NEAR AI server and see requests from that day.

Sources (original reporting)

More stories from this day