Notion confirmed that the Fireworks AI breach exposed chat transcripts from its Notion AI service, turning a vendor breach into a direct data exposure for one of the most widely used productivity platforms.

TechCrunch reported on Thursday that the breach affected fewer than 1% of Notion workspaces, citing Notion’s own disclosure. The transcripts came from Notion AI chats that Notion had sent to Fireworks to power Insights, a feature that shows workspace administrators how their members use AI.

Notion said the exposed material covers “any input to or output from the model that was written to the chat,” and it urged affected customers to treat the data as exposed. On November 11, Notion revoked API keys it found pasted into the affected messages during its investigation.

What was exposed

The exposed data is the set of Notion AI chat transcripts used for the Insights feature. According to Notion’s notice, the transcripts include everything users typed into those chats, along with the model’s replies. For the vast majority of affected workspaces, Notion said the transcripts were “unattributable”: they carried no labels identifying the author or the workspace, and they did not include tool-call results.

Unattributable does not mean harmless. A transcript can still contain whatever a user typed, including a password, an API key, a customer list or a contract. Notion said audio, transcripts and summaries from AI Meeting Notes were not affected, unless they were used as an input in a chat transcript with Notion AI. No other Notion features were affected.

On the Fireworks side, the attackers also took billing information and, for some customers, parts of datasets and incomplete model weights, according to Fireworks’ security bulletin. Payment card numbers were not affected, because Fireworks says it does not store them.

Timeline of the Fireworks AI security incident, from the October 23 cloud provider incident to Notion revoking API keys on November 11

How the incident unfolded, from the October 23 intrusion to Notion’s November 11 key revocations. Graphic: GPTOnline. Sources: Notion, Fireworks AI, TechCrunch.

How the breach unfolded

The intrusion began outside Fireworks. A third-party cloud provider hosting the company’s research and development machines experienced a security incident on October 23. On October 24, the attacker used that opening to reach Fireworks development machines and run an unauthorized workload. Fireworks said it detected the activity the same day.

Fireworks first alerted Notion on November 2, about a dataset that appeared to contain only synthetic test data. By the morning of November 3, Notion had disconnected its systems from Fireworks, deleted all of its data there and stopped all connectivity. On November 6, Fireworks said customer data may have been accessed, and on November 8 it confirmed that the final dataset included real customer chats. Notion began contacting affected customers on November 9, the same day Fireworks published its updated bulletin.

Fireworks said the evidence links the attack to a financially motivated group selling unauthorized access to large language models, a practice known as LLMjacking that Google’s Threat Intelligence Group and Mandiant warned about on November 2.

A broken zero-retention promise

The most consequential detail in Notion’s notice may be about data retention. Notion said Fireworks had given it a contractual commitment to zero data retention for its use of the platform. “Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used,” Notion wrote.

Notion explained that its zero data retention commitments cover API requests sent to third-party model vendors, but not product features that require the data to be stored, such as chat history and Insights. Notion said it is now auditing critical vendors, including inference providers and data processors, to verify that they follow data minimization practices, including zero data retention policies.

What Notion and Fireworks are doing

Notion has disabled Insights while the investigation continues, and it is no longer serving open-weight models through Fireworks. Workspace owners can review the affected data in a “Security incident review” section inside their workspace, and members can review their own affected content.

Notion recommends that anyone who pasted sensitive information, such as passwords, API keys or other credentials, into Notion AI during the incident window rotate those credentials right away.

Fireworks said it notified law enforcement and brought in Palo Alto Networks Unit 42 for forensic analysis. Working with Unit 42, the company revoked and replaced credentials and service accounts, removed unnecessary elevated permissions and restricted network pathways, and disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training.

Key figures from the Fireworks AI breach: fewer than 1 percent of Notion workspaces affected, tens of thousands of Fireworks customers, intrusion on October 23 to 24

Key figures from the incident. Graphic: GPTOnline. Sources: Notion, Fireworks AI, TechCrunch.

Why it matters

This is the second Fireworks incident in as many months, and the Fireworks AI breach is the first confirmed case of a major downstream customer having its users’ AI conversations exposed. The company first disclosed unauthorized use of its internal credentials in evaluation jobs on October 6, and its November 9 update widened the impact to datasets, incomplete model weights and billing information, as we reported at the time.

The incident also shows how far a vendor breach can travel. A chat transcript is not a password database, but for many users it is where sensitive work happens, and too often it holds credentials pasted in for convenience. When a vendor retains data it promised not to keep, the exposure is not limited to the vendor’s own customers.

Security firm Wiz counted nine AI developer platforms that disclosed incidents in October, a wave that suggests AI infrastructure has become a prime target. The disclosure lands hours before OpenAI’s “Cyber at the Frontier” keynote, scheduled for 10:00 a.m. PT (18:00 UTC) on Thursday, where the company is expected to present its own security work.

Sources