Cybersecurity

Notion Says the Fireworks AI Breach Exposed Notion AI Chat Transcripts From Under 1% of Workspaces

The transcripts came from data Notion sent to Fireworks for its Insights usage feature. Notion has switched Insights off, stopped serving open-weight models through Fireworks, and is telling affected customers to rotate any credentials they pasted into chats.

DailyMech Staff

Published

Last updated / Fact-checked on

Notion Says the Fireworks AI Breach Exposed Notion AI Chat Transcripts From Under 1% of Workspaces
albarus / Pixabay — Pixabay Content License

A brass padlock resting on the dark keys of a laptop keyboard

Illustrative photo of a brass padlock on a laptop keyboard; it is not Notion's or Fireworks AI's equipment. The padlock carries its maker's engraved brand name, which has no connection to this story.

Notion has confirmed that the security breach at its AI infrastructure provider, Fireworks AI, exposed Notion AI chat transcripts belonging to some of its customers. In a security advisory first published on November 12 and updated again on Friday, Notion said the incident affects fewer than 1% of Notion workspaces and that it has contacted the customers it identified as affected.

TechCrunch described Notion as at least one confirmed affected customer of the Fireworks incident. The disclosure turns what had been a story about one AI vendor's development systems into a lesson about how far data travels once a company plugs third-party AI services into its product.

At a glance

Item Detail Source
What was exposed Notion AI chat transcripts used for the Insights feature Notion advisory
Scope Fewer than 1% of Notion workspaces Notion advisory
Attribution For most affected workspaces, chats were not labeled with a user or workspace Notion advisory
Notion's response Disconnected from Fireworks Nov. 3, deleted its data there Nov. 4, disabled Insights Notion advisory
Customer advice Treat the data as exposed; rotate any passwords, API keys or credentials pasted into Notion AI Notion advisory

What Notion says happened

Notion's advisory lays out a timeline that shifted as the investigation went on. On the evening of November 2, Fireworks told Notion that a small set of data had been accessed by malicious actors. Notion's first look found only synthetic test data for Notion AI, and no customer data.

As a precaution, Notion cut its systems off from Fireworks by the morning of November 3 and stopped all communication between the two. On November 4 it deleted all of its data held in the Fireworks system. BleepingComputer, citing Notion, reported that Notion also halted training runs by November 3.

The picture changed on November 6, when Fireworks told Notion that attackers may have reached potential customer data. Fireworks confirmed the final affected dataset on November 8, and Notion began contacting affected customers on November 9.

Analyzing that dataset, Notion found it contained Notion AI chat transcripts used for Insights, a feature that helps customers, and in particular workspace administrators, understand how their teams use Notion AI. According to TechCrunch, Notion said the transcripts include "any input to or output from the model that was written to the chat."

Why "unattributable" matters, and its limits

Notion stresses that, for the large majority of affected workspaces, the transcripts were "unattributable." In its words, that means "the chats weren't labeled with who wrote them or which workspace they came from, and the transcripts did not contain tool call results." Beyond the text of the chats themselves, Notion says, nothing ties them back to a workspace, user or company.

That is a meaningful limit on the damage, but it is not a guarantee of anonymity. A chat transcript can identify its author through its own contents, such as a name, a client, a project or a pasted document. Notion appears to recognize this: it tells affected customers to "treat this data as if it were exposed," and to rotate any passwords, API keys or other credentials they may have pasted into Notion AI during the incident window.

The company's latest updates show it acting on that risk itself. On November 11, Notion said, it revoked exposed Notion API keys that it found inside affected user messages. On November 12, it reported exposed third-party API keys found in those messages to the vendors that issued them, an update Notion posted on Friday.

Affected workspace owners can retrieve and review the impacted data inside their workspace, with instructions sent by email. BleepingComputer reported that owners can do this through a security incident review in Notion's desktop web interface and can share a link that lets members download their own transcripts. Notion says customers who have not heard from it have not been identified as affected and do not need to act for now, though its investigation continues.

How Notion used Fireworks

Fireworks AI is a platform developers use to run open AI models. Notion says it used the service in two ways: for classification jobs behind Insights, and as a general inference provider to serve open-weight models inside Notion's product. Insights has been disabled during the investigation, and Notion says it is no longer serving open-weight models through Fireworks. No other Notion features were affected, according to the advisory.

BleepingComputer reported that Notion's FAQ on the incident notes Fireworks had contractually committed to zero data retention for Notion data. DailyMech did not read that FAQ directly. Notion's advisory, for its part, frames the episode as "not a breach of our systems," while adding that it intends to "raise the standard" for how customer data is protected.

The Fireworks side of the story

Fireworks has said an attacker breached its cloud provider and used that access to reach a Fireworks development system, TechCrunch reported. BleepingComputer, describing Fireworks' disclosure, said the attacker got in through a third-party cloud provider on October 23 and compromised resource metadata, billing information, model weights and datasets for some customers.

Fireworks told TechCrunch it believes the attackers are financially motivated and focused on selling tokens, meaning access to large language models, to unauthorized third parties who can then run up AI usage without paying for it. TechCrunch noted that this is the second breach affecting Fireworks in as many months; BleepingComputer reported that in early October hackers reached environment variables containing API keys and tokens stored as secrets for a limited number of accounts.

Fireworks says it serves tens of thousands of customers. TechCrunch named legal-tech company Harvey and AI coding company Cursor among them; neither has been reported as affected in the sources DailyMech read.

What it means for companies building on AI vendors

The Notion case shows a supply chain problem that is easy to overlook. A user typing into Notion AI is unlikely to think about which inference provider sits behind a particular feature, or that an analytics feature like Insights might send conversation text to a separate company for classification. When that downstream provider is breached, the exposure lands on the original platform's customers.

For security teams, the practical takeaways are familiar but newly urgent:

  • Map which features send user content to outside AI providers, and for what purpose.
  • Treat anything pasted into an AI chat, including keys and passwords, as data that may be stored and processed elsewhere.
  • Check how vendors' retention promises are enforced, not just written into contracts.
  • Plan credential rotation for when, not if, a provider reports an incident.

What to watch

Notion says its investigation is ongoing and that it will update its advisory as it learns more. The open questions are whether more Fireworks customers disclose impacts, what Fireworks' final accounting of the breach shows, and whether the reported third-party keys found in Notion users' messages are revoked before anyone can use them.

How we reported this

DailyMech read Notion's security advisory, TechCrunch's November 12 report and BleepingComputer's November 11 report in full. The timeline, scope and recommended steps are Notion's own account. Statements attributed to Fireworks come from TechCrunch's and BleepingComputer's reporting on its disclosures; DailyMech did not read Fireworks' advisory or Notion's FAQ for this article and contacted no one.

Published November 13, 2026. Facts checked against the cited sources by DailyMech's AI writer.

Sources

DailyMech used AI tools to research and draft this article. Facts were checked against the cited sources by DailyMech's AI writer, not by a human editor.

In Cybersecurity

From other sections

Sections