Threat
Notion says Fireworks breach exposed customer AI chat transcripts
First reported bleepingcomputer.com
Page published · Page updated
Earliest dated coverage: 11 Nov 2026 · First observed: 11 Nov 2026 · Latest dated coverage: 11 Nov 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
The Fireworks AI breach demonstrates that third-party AI infrastructure compromises can expose assistant conversations despite contractual zero-data-retention commitments.
A breach at Fireworks AI, Notion's AI infrastructure provider, exposed Notion AI chat transcripts from its Insights dataset after an attacker accessed Fireworks' development environment through a third-party cloud provider. Notion says fewer than 1% of users were affected; transcripts for the vast majority of impacted workspaces lacked user or workspace labels, and the transcripts contained no tool-call results. Notion cut off traffic to Fireworks, deleted its data from the provider, halted training runs, and disabled the affected dataset.
Summary
Notion disclosed that a security breach at its AI infrastructure provider, Fireworks AI, exposed Notion AI chat transcripts associated with the Insights feature. The exposure affected a small number of workspaces, with Notion reporting that less than 1% of its users were impacted. The exposed Insights dataset has been disabled.[0]
The report connects the incident to an October 23 intrusion into Fireworks AI's development environment through a third-party cloud provider. Fireworks reported compromise of resource metadata, billing information, model weights, and datasets for some customers. The article also describes a separate early-October Fireworks breach involving API keys and tokens stored in environment variables; it does not establish that this earlier incident caused the Notion transcript exposure.[0]
The assessment of the exposed data changed during the response. Fireworks alerted Notion on November 2 about a dataset initially described as containing only synthetic test data. By November 3, Notion had cut off traffic to Fireworks, deleted its data from the vendor's systems, and halted training runs. On November 8, Fireworks confirmed customer-data access, and Notion identified Insights chat transcripts in the dataset supplied for analysis.[0]
Notion said transcripts for the vast majority of impacted workspaces lacked author and workspace labels, and that the transcripts contained no tool-call results. Those limitations do not eliminate the need to assess the chat text: Notion directs potentially affected workspace owners to its Security incident review interface and advises users to rotate credentials entered in affected chats. The supplied reporting does not identify a named attacker, a specific exploited vulnerability, or actionable attacker infrastructure.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Notion AI — Insights dataset processed by Fireworks AI | Chat transcripts from a small number of workspaces; Notion reports that less than 1% of its users were impacted. The report provides an affected-service scope rather than software version boundaries. | No software patch is identified in the report. The exposed Insights dataset has been disabled. Notion also reported cutting traffic to Fireworks, deleting its data from the vendor's systems, and halting training runs by November 3.[0] |
Key takeaways
- The confirmed Notion impact is exposure of Insights chat transcripts, not a demonstrated compromise of every Notion workspace or every category of Notion content. Notion reports an affected population below 1% of users.[0]
- The initial synthetic-data assessment was superseded by confirmation of customer-data access on November 8. Incident review should use the later transcript-level findings rather than the initial description.[0]
- “Unattributable” describes missing author and workspace labels; it should not be treated as assurance that the conversation text contains no sensitive material. Notion still recommends rotating credentials entered into affected chats.[0]
- Notion reported a contractual zero-data-retention commitment from Fireworks despite the presence of exposed transcripts in the Insights dataset. Both the contractual commitment and the reported exposure matter to understanding this vendor incident.[0]
- All substantive findings in the supplied evidence rest on one news report, including its quotations and summaries of Notion statements. No separate vendor advisory body, exploit detail, or attacker indicator is supplied for independent corroboration.[0]
Defensive actions
- Potentially affected workspace owners should open Security incident review in Notion's desktop web interface and review the exposed data.: Notion identifies this interface as the way for potentially affected owners to examine the data associated with the incident, allowing review to focus on the actual exposed transcripts.[0]
- Workspace owners should share the incident-review link that allows affected members to download their own transcripts.: The member download workflow lets users inspect their own exposed conversations and determine whether they entered credentials that require rotation.[0]
- Rotate any passwords, API keys, or other credentials entered into affected chats.: Notion explicitly recommends credential rotation for secrets present in exposed conversations. Missing author or workspace labels do not remove the need to review credentials within the transcript text.[0]
- Apply Notion's notification-based scope guidance: when neither a user nor their workspace owner has received a notice, no action is needed for now.: Notion says those users are most likely not part of the impacted subset. This is qualified guidance, not a definitive guarantee that every unnotified account is unaffected.[0]