Notion says Fireworks breach exposed customer AI chat transcripts

Less than 1% of Notion users are affected by a security breach at Fireworks AI that exposed Notion AI chat transcripts, the workspace vendor disclosed. The incident marks the second confirmed compromise at Fireworks AI in a single month.

Notion, a cloud-based platform for note-taking, document creation, internal wikis, project management and task tracking, learned of the exposure through its AI infrastructure provider. Fireworks AI confirmed on November 8 that an attacker had accessed customer data, including that of Notion users.

What happened at Fireworks AI?

Fireworks AI first disclosed a breach in early October. Hackers accessed environment variables containing API keys and tokens stored as secrets for a limited number of accounts.

A second intrusion followed. On October 23, an attacker accessed Fireworks' development environment via a third-party cloud provider and compromised resource metadata, billing information, model weights and datasets for some customers.

Fireworks enables Notion to run some of the open-weight models (models with publicly available parameters) available through Notion AI. The vendor also analyzes stored conversations for Insights, a feature that gives workspace administrators visibility into how their teams use AI.

How did Notion respond?

Notion received an alert from Fireworks on November 2 about an exposed dataset that reportedly contained only synthetic test data. The company acted within a day. It cut off traffic to Fireworks, deleted all data from the vendor's systems, and halted training runs by November 3.

The reassurance did not hold. Fireworks confirmed on November 8 that real customer data had been accessed, including Notion users' data.

"Upon analysis of the dataset Fireworks AI gave us on November 8, we discovered that it included Notion AI chat transcripts used for the Insights feature, which for the vast majority of impacted workspaces were unattributable," Notion stated in an update.

Notion explained the term plainly. "Unattributable means the chats weren't labeled with who wrote them or which workspace they came from, and the transcripts did not contain tool call results."

The exposed transcripts came from the Insights dataset specifically. Notion has now disabled that dataset.

What are the contractual implications?

Notion published an FAQ page on the incident. It states Fireworks had contractually committed to zero data retention for Notion data. That commitment now sits against a confirmed access of customer transcripts at the vendor.

The company quantified the blast radius: less than 1% of its users are impacted by the incident. Notion did not state an absolute number of affected workspaces.

What should affected customers do?

Notion laid out concrete steps for impacted users and administrators:

• Potentially affected workspace owners should review the data through Security incident review in Notion's desktop web interface.
• Owners should share a link with members that lets them download their own transcripts.
• Affected users should rotate any passwords, API keys or other credentials entered into affected chats.
• If neither a user nor their workspace owner has received a notice, no action is needed, and they are most likely not part of the impacted subset.

The episode underscores third-party risk in enterprise AI stacks. Notion's own systems were not breached; the exposure ran through a model-hosting vendor that held conversation data despite a zero-retention commitment. Security teams procuring AI services face the same vendor chain: model weights, datasets and API secrets all sat inside Fireworks' environment, and attackers reached them twice in October.