Notion Says Fireworks AI Breach Exposed Notion AI Chat Transcripts, Urges Users to Rotate Pasted Credentials

By Kaeleb Savon Heck

DAVAO DEL NORTE, Nov. 12, 2026 — Notion says a breach at one of its artificial intelligence vendors exposed transcripts of conversations people had with Notion AI, the chatbot built into the popular workspace app, in what the company says is fewer than 1 percent of its workspaces.

The vendor is Fireworks AI, a company that runs AI models for other businesses. Fireworks disclosed this week that attackers who first hit it in early October came back later in the month through a third-party cloud provider, reached its development machines and ran an unauthorized workload that touched more customer data than it first reported. Among the data taken was a set of Notion AI chat transcripts that Notion had been using for a feature called Insights.

Notion says most of those transcripts were "unattributable," meaning they were not labeled with the person or workspace they came from. But the company is telling affected customers to treat the data as exposed, and to change any passwords, API keys or other credentials they may have pasted into Notion AI during the incident window. On Nov. 11, Notion said it had revoked Notion API keys that it found exposed during its investigation.

The case is a sharp example of a risk many people don't think about when they type into an AI chatbot: the words may pass through several companies, not just the one whose logo is on the app.

What Notion says happened

Notion laid out its timeline on a security advisory page it has updated several times since.

• Nov. 2: On the evening of Nov. 2, Fireworks told Notion that a small set of data had been accessed by malicious actors. Notion says that dataset contained Notion AI synthetic testing data, not customer data.
• Nov. 3: By the morning of Nov. 3, Notion says it disconnected its systems from Fireworks, deleted all of its data in the Fireworks system and stopped all communication between the two companies' systems.
• Nov. 6: Fireworks told Notion that the attackers may have accessed potential customer data, and Notion started another internal investigation.
• Nov. 8: Fireworks confirmed the final affected dataset.
• Nov. 9: Notion began contacting affected customers.
• Nov. 11: Notion said it revoked exposed Notion API keys found during the investigation.

"Upon analysis of the dataset Fireworks AI gave us on November 8, we discovered that it included Notion AI chat transcripts used for the Insights feature, which for the vast majority of impacted workspaces were unattributable," Notion wrote. The company said the transcripts did not contain tool call results, the data an AI assistant pulls in when it searches or acts on other content, and that "beyond what's in the chat transcript itself, there's no information tying the chat back to workspaces, users, or companies."

Notion said no other features were affected. It has turned off Insights while it investigates and has stopped serving open-weight AI models through Fireworks.

What Fireworks says happened

Fireworks' story starts a month earlier. According to The Hacker News, the company first posted a notice on Oct. 10 saying it had detected, on Oct. 6, the unauthorized use of internal Fireworks credentials. That let an outside party read environment variables, including API keys and tokens stored as secrets, used in evaluation jobs for a limited number of customer accounts. At the time, Fireworks said it saw no sign that customer models, datasets, training data, inference traffic or personal information had been reached.

The new bulletin is broader. Fireworks now says the attackers got into its development environment on Oct. 23 through an unnamed third-party cloud provider that hosted its research and development machines. "On October 24, the unauthorized third party used it to reach Fireworks development machines and then run an unauthorized workload that led to additional customer data impact," the company said, as quoted by The Hacker News. Fireworks said that as of Oct. 25 it had not detected further successful unauthorized access to the platform customers use.

For a limited set of accounts, Fireworks says the second wave reached resource metadata such as names and descriptions, billing details such as billing and shipping addresses, invoice and payment history, account balances and credit usage, and a subset of incomplete model weights and datasets. Fireworks said it does not store payment card numbers.

The company tied the activity to a financially motivated cybercriminal group "aimed at selling tokens from unauthorized access to large language models (LLMs) to illicit routing gateways." That practice is often called LLMjacking: criminals steal access to someone else's AI account, resell it, and leave the real customer with the bill.

Background: a busy season for AI platform breaches

This is not the first time Fireworks has come up in the Chronicle. Its early-October incident was one of a string of breaches at AI developer platforms that we covered on Nov. 1, in a report on the Northflank breach and the wave of attacks some in the industry called "Black October," driven in part by a resale market for stolen AI keys.

What is new is how the problem has moved downstream. In October, the main worry was stolen developer secrets. Now a mainstream app with a huge user base is telling ordinary customers that some of their own words, typed into a chatbot, ended up in a stolen dataset.

The Hacker News also reported that Google warned last week that attackers are increasingly targeting AI infrastructure for LLMjacking in North America, South America and the Asia-Pacific region, across finance, retail, technology and transportation.

The promise that didn't cover this

Notion's own FAQ, as reproduced from its help center, says the company had a contractual commitment from Fireworks of zero data retention for Notion data, and describes zero data retention as a commitment it makes to enterprise customers for the requests it sends to outside AI model vendors.

The incident shows the limits of that kind of promise. Notion says it used Fireworks in two ways: as a general provider to run open-weight models inside its product, and for classification jobs behind Insights, a feature meant to help customers understand their own AI usage. The exposed transcripts came from the Insights data. A promise not to keep live requests does not automatically cover data a company sends a vendor for a separate analytics job.

Analysis: why this hits closer to home

People treat AI chat boxes like a private notepad. They paste in a work email to rewrite, a contract to summarize, a block of code with a key still in it, or a personal note they would never post anywhere. This breach is a reminder that the chat box is not a vault.

For blind and low-vision users, the lesson is sharper. Many of us lean on AI assistants more than most, because they can read, summarize and describe things that are hard to get through with a screen reader alone. That often means pasting in exactly the kind of material, like bank letters, medical paperwork or account details, that would hurt if it leaked. The fact that most of Notion's exposed transcripts were not labeled with a name is some comfort, but the content of a chat can identify a person on its own if it includes a name, an address or an account number.

Notion's practical advice is the right one, and it applies beyond Notion: if a secret ever went into an AI chat, assume it could get out, and change it.

There is also an accessibility point in Notion's instructions. The company says the Security incident review tool for affected workspaces must be used in a desktop browser with the latest version of Notion and is not available on mobile. That may be a hurdle for people who rely mainly on a phone and its screen reader.

What affected users should do

Notion says it has contacted the customers it identified as affected. If you have not heard from Notion, the company says it has not identified your workspace as affected and no action is needed right now, though its investigation continues.

According to Notion's help documentation:

• Workspace owners of affected workspaces can open the review tool from the workspace sidebar by choosing the help menu and then Security incident review.
• Owners can download a CSV listing affected members, and can generate a link that lets each member see only their own affected data.
• Owners with a verified domain can download the affected content itself, including an annotated version that flags possibly sensitive information so credentials can be rotated quickly.
• Anyone who pasted passwords, API keys or other credentials into Notion AI during the incident window should change them now.

What's next

• Notion's investigation: Notion says it is still investigating and will contact any additional workspaces it finds were affected.
• Fireworks' customer notices: Fireworks says it is alerting customers whose data was affected, and it has rotated credentials, isolated affected systems and tightened access controls and logging.
• The Insights feature: It stays disabled during the investigation. Notion has not said when, or whether, it will return.
• Vendor scrutiny: Expect more questions for any app that sends user AI conversations to outside providers, especially about what is sent for analytics and training rather than for answering a request.

Sources

• Notion, "Fireworks AI incident" security advisory: https://www.notion.com/security/advisories/security-incident-involving-a-third-party-ai-vendor
• Notion Help Center, "Security incident involving a third-party AI vendor": https://www.notion.com/help/security-incident-involving-a-third-party-ai-vendor
• The Hacker News, "Fireworks AI Confirms Wider Breach Affecting Customer Datasets, Model Weights and Notion AI Chats": https://thehackernews.com/2026/11/fireworks-ai-breach-widens-to-expose.html
• BleepingComputer, "Notion says Fireworks breach exposed customer AI chat transcripts": https://www.bleepingcomputer.com/news/security/notion-says-fireworks-breach-exposed-customer-ai-chat-transcripts/
• The Blindbandit Chronicle, earlier coverage of the Northflank breach and "Black October": https://mrblindbandit.net/publications/northflank-breach-black-october-ai-developer-platforms-llmjacking/