原标题：Cyberattack on Fireworks AI allowed hackers to access Notion customers’ chat transcripts
开发者平台 Fireworks AI 遭受网络攻击，攻击者入侵其云提供商并进入开发系统，窃取了部分客户的账单信息和数据集。Notion 确认约 1% 的自家客户受影响，被窃数据包括使用 “Insights” 功能的 Notion AI 客户的聊天记录，Notion 已于 11 月 3 日断开与 Fireworks 的全部连接。Fireworks 认为攻击者以牟利为目的，主要靠窃取大语言模型访问权限倒卖 token，且这是该公司两个月内第二次安全事件。
原文梳理了攻击路径和 Notion 客户端聊天记录被窃的具体影响范围，并指出攻击者的获利方式是倒卖 LLM token。
本页的摘要、推荐理由与解读出自 AIsa Studio 的 AI 风向智能体，原文版权归原作者所有。
A cyberattack at Fireworks AI has exposed some of its customers’ data, the company has confirmed. Fireworks AI, a platform that developers use to access and use open AI models, said an attacker breached its cloud provider to gain access to a Fireworks development system, which allowed access to some of its customers’ data.
The company said in its latest security advisory that the cybercriminals took Fireworks’ customers’ billing information and some datasets. Fireworks touts tens of thousands of customers worldwide using its platform, including legal tech company Harvey and AI company Cursor.
At least one confirmed affected customer is online document editor and notetaker Notion, which said in a disclosure that the breach affected around 1% of its own customers.
Notion said that Fireworks alerted the company to a security incident and later confirmed that the hackers had stolen some Notion customer data. On November 3, Notion said it disconnected its systems from Fireworks, deleted the data stored in its systems, and stopped all connectivity between the two.
Notion confirmed this week that the hackers took chat transcripts of its Notion AI customers who used the “Insights” feature. The company said that the transcripts include “any input to or output from the model that was written to the chat,” but added that much of the data was unattributable and could not be determined from which customer it was obtained.
The breach at Fireworks AI shows how tech companies are reliant on other tech providers for their own offerings, and how cyberattacks can, as a result, spill over into other customers.
Fireworks said that it believes the hackers are financially motivated and that their goals are focused on selling tokens from breaching access to large language models, or LLMs. These schemes rely on selling to unauthorized third parties, who can burn through AI model usage without using their own resources.
This is the second breach affecting Fireworks in as many months, following a security incident in October.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Zack Whittaker is the security editor at TechCrunch. He also authors the weekly cybersecurity newsletter, this week in security.
He can be reached via encrypted message at zackwhittaker.1337 on Signal. You can also contact him by email, or to verify outreach, at [email protected].
原文版权归 TechCrunch · AI 及原作者所有，本站转载仅供阅读。如需删除，请联系 support@aisa.one。
Studio