Notion AI chats exposed in Fireworks AI breach at under 1% of workspaces
Notion has confirmed that chat transcripts from Notion AI were exposed in a security incident at Fireworks AI, a third-party AI infrastructure provider that Notion used for parts of its AI stack. In a security advisory updated on November 10, 2026, the company says the incident affects fewer than 1% of Notion workspaces, that the exposed data consists of Notion AI chat transcripts used for the Insights feature, and that no other Notion features were affected. Notion contacted the affected customers on November 9.
The exposure did not come from a breach of Notion's own systems. Fireworks AI, which Notion used to run classification jobs for Insights and as a general inference provider for open-weight models, told Notion that malicious actors had accessed data held on the Fireworks side. Notion's first review found only synthetic testing data in that set. A second notification from Fireworks on November 6 widened the scope to potential customer data, and Fireworks confirmed the final impacted dataset on November 8.
Notion has disabled the Insights feature while it investigates and no longer serves open-weight models through Fireworks. For the vast majority of affected workspaces, Notion says the transcripts were unattributable: they carried no label identifying the author or the workspace and did not contain tool call results. The company still recommends that affected customers treat the data as exposed and rotate any passwords, API keys or other credentials pasted into Notion AI chats during the incident period.
··········
WHAT NOTION SAYS WAS EXPOSED FROM NOTION AI INSIGHTS.
According to the advisory, the affected material falls into two groups. The first is Notion AI synthetic testing data, which Fireworks flagged on November 2 and which Notion says contained no customer data. The second, confirmed on November 8, is a set of Notion AI chat transcripts that had been sent to Fireworks for processing in the Insights feature. That second dataset is the one that touches real customers.
Notion describes the transcripts as unattributable for most impacted workspaces. In practice this means the records were stored without the name of the person who wrote the prompt and without a workspace identifier, and they did not include the results of tool calls, which in Notion AI can carry content pulled from pages, databases or connected apps. The advisory does not say how many transcripts were involved, what date range they cover or how many individual users are behind them, and it does not specify which Notion plans the affected workspaces were on.
The company states that no other Notion features were affected and that it continues to monitor the incident. Fireworks, for its part, says that its inference product, its Training SDK and its Nexus product run with zero data retention by default and have not been found affected so far. The Notion data sat in a different part of the Fireworks platform, tied to the classification jobs Notion ran for Insights.
··········
NOTION AND FIREWORKS AI INCIDENT TIMELINE.
The two companies' official pages describe a sequence that began in early October with a credential misuse at Fireworks and reached Notion customer data only in November. The table combines the dates published by both companies.
........
Date (2026) | Event | Source |
October 6 | Fireworks identifies unauthorized use of internal credentials and starts containment | Fireworks bulletin |
October 9 | Fireworks publishes its first security bulletin | Fireworks bulletin |
October 23 | Security incident at a third-party cloud provider hosting Fireworks R&D machines | Fireworks update |
October 24 | Unauthorized party reaches Fireworks development machines and runs a workload with further customer data impact | Fireworks update |
November 2 | Fireworks tells Notion a small dataset was accessed; Notion finds only synthetic testing data | Notion advisory |
November 3 | Notion disconnects from Fireworks and deletes all its data in the Fireworks system | Notion advisory |
November 6 | Fireworks warns that potential customer data may have been accessed; Notion opens a second investigation | Notion advisory |
November 8 | Fireworks confirms the final impacted dataset | Notion advisory |
November 9 | Notion contacts impacted customers; Fireworks posts its latest update | Both |
November 10 | Notion publishes the revised advisory, with no change to reported facts | Notion advisory |
........
Two details stand out in this sequence. Notion cut its connection to Fireworks on November 3, before it knew that customer transcripts were involved, so the deletion of its data on the vendor side happened as a precaution. The confirmation that real customer transcripts were in the accessed set came five days later, which is why the customer notices went out on November 9 rather than at the time of the first alert.
··········
HOW THE FIREWORKS AI BREACH REACHED NOTION AI DATA.
Fireworks AI first disclosed a problem on October 9. In that bulletin the company said that internal Fireworks credentials had been used without authorization, giving a third party access to environment variables used in evaluation jobs in a limited number of customer accounts. Those variables included API keys and tokens stored as secrets. At that stage Fireworks said it had found no evidence of access to customer models, datasets, training data, inference traffic or personal information.
The picture changed with a later update. Fireworks now says that a security incident on October 23 at a third-party cloud provider hosting its R&D machines gave the attacker a path into Fireworks development machines, where on October 24 the unauthorized party ran a workload that caused additional customer data impact. The data Fireworks lists as affected in that second phase includes resource metadata such as identifiers, display names and descriptions, billing information such as addresses, invoice history and credit usage, secrets for a limited set of accounts, and, for certain customers, a subset of incomplete model weights and datasets. Fireworks says it does not store payment card numbers and that none were affected.
Fireworks attributes the activity to a financially motivated threat actor group associated with LLMJacking, the practice of abusing stolen cloud and AI credentials to run or resell model access. The Fireworks pages do not give a total number of affected customers, and they do not name Notion. The link between the two incidents comes from Notion's own advisory, which identifies Fireworks as the vendor and describes the datasets it was told about.
For readers following AI vendor security, the case resembles other recent incidents in which data left a provider's perimeter through a partner rather than through the product people use directly, such as the Claude account data exposure reported to Korea's privacy regulator. In the Notion case, the customer-facing product was never breached, yet data typed into it ended up in the hands of an attacker because it had been passed to an inference and processing vendor.
··········
WHAT NOTION AI USERS AND WORKSPACE ADMINS SHOULD DO NOW.
Notion's guidance depends on whether a workspace received a notice. Workspaces that have not been contacted have not been identified as affected, and Notion says no action is needed for them at this time. Affected customers were emailed instructions to retrieve and review the impacted data securely inside their workspace, and Notion recommends treating that data as if it were exposed.
........
Situation | What Notion says to do |
No email from Notion | No action needed now; workspace not identified as affected |
Affected workspace | Follow the emailed steps to review the impacted data inside the workspace |
Passwords or API keys pasted into Notion AI | Rotate them with the issuing service |
Other sensitive data pasted into Notion AI | Treat it as exposed |
Workspaces found later | Notion says it will contact them directly |
........
The credential advice is the most concrete step. Anyone who pasted a password, an API key, an access token or similar secrets into a Notion AI chat during the incident period should rotate that credential at the service that issued it. Notion's advisory does not define the exact incident window, so admins of affected workspaces who cannot rule out a secret being pasted into a chat may prefer to rotate across the whole period in which Insights was active. Deleting the chat in Notion does not invalidate a credential that has already been copied.
Workspace administrators can also use the notice to check internal policies. Teams that let employees paste customer records, contracts or code containing secrets into AI chats may want to review which kinds of content are allowed in Notion AI, and to remind staff that the assistant's prompts may be processed by subprocessors outside Notion. Notion has not announced changes to its plans, admin controls or pricing in connection with the incident.
··········
WHAT CHANGES IN NOTION AI AFTER THE FIREWORKS INCIDENT.
Two product changes follow directly from the advisory. The Insights feature is disabled while the investigation continues, and Notion has not given a date for its return. Notion also no longer serves open-weight models through Fireworks, which ends the vendor's role as a general inference provider for those models in Notion AI. The advisory does not say which provider, if any, now serves the open-weight models that Notion previously ran on Fireworks, or whether users will see any difference in model availability.
On the Fireworks side, the company has disabled self-serve dataset uploads and downloads for Batch Inference and dataset-based training during the investigation. Its October bulletin also lists revoked internal credentials, revoked customer API keys and rotated service-account tokens. Fireworks says it is notifying affected customers directly with recommended response actions, and that customers who did not receive a notice currently have no incident-specific action to take.
··········
NOTION AI FIREWORKS BREACH: CONFIRMED FACTS AND OPEN QUESTIONS.
Notion has confirmed the vendor, the affected feature, the scale in relative terms and the dates. The exposed data is Notion AI chat transcripts processed for Insights, held by Fireworks AI, affecting fewer than 1% of workspaces, with most transcripts carrying no author or workspace label and no tool call results. Affected customers were contacted on November 9, Insights is switched off, and open-weight model serving through Fireworks has ended. Fireworks has separately confirmed that an attacker reached its development machines through a third-party cloud provider incident and accessed customer data, secrets and some model weights for a subset of accounts.
Several points remain undisclosed. Neither company has published the number of transcripts or users affected, the date range of the exposed chats, the Notion plans involved or the precise technical entry point. Notion has not said whether attributable transcripts exist in the minority of workspaces not covered by the "vast majority" wording, and it has not given a date for restoring Insights. Both investigations are described as ongoing, so the scope could still change, and Notion has committed to contacting any additional workspace it later finds was impacted.
··········
FOLLOW US FOR MORE.
·····
DATA STUDIOS
·····
datastudios.org
