Notion: Fireworks AI breach exposed Notion AI chat transcripts from under 1% of workspaces

Notion says a breach at Fireworks AI, a company that ran some of Notion AI's models, exposed Notion AI chat transcripts from fewer than 1% of Notion workspaces. Notion has contacted the affected customers directly. If you got a notice, treat those chats as exposed and rotate any password, API key or other credential that was pasted into Notion AI. If neither you nor your workspace owner got one, Notion says no action is needed for now.

This is an update to our November 10 report on the Fireworks AI breach. Fireworks' own bulletin does not name any customer; Notion is the first to say publicly that its users' data was involved.

What happened, in plain English

Notion is a workspace tool for notes, documents and wikis. Its built-in assistant, Notion AI, answers questions and writes text. Like many software companies, Notion does not run every AI model itself. Some of the work goes to inference providers: outside companies that run AI models on their own hardware for a fee.

One of those providers was Fireworks AI. According to Notion's security advisory, first published November 9, 2026, Notion used Fireworks in two ways: as a general provider to serve open-weight models (models whose files are publicly released), and for classification jobs for a feature called Insights. Insights shows workspace administrators how their teams use AI. To do that, a set of Notion AI chat transcripts was stored and analysed at Fireworks.

Fireworks was breached in October. In the second intrusion, which started October 23–24, an attacker got in through a separate cloud company that hosted Fireworks' research machines. Notion now says the data the attacker reached included "Notion AI chat transcripts used for the Insights feature."

An analogy: you hire a cleaning contractor who takes some of your paperwork back to their depot to sort it. Burglars break into the depot. Your office was never touched, but some of your papers were sitting where the burglars went.

Notion says no other Notion features were affected, and that for most affected workspaces the transcripts carry no author or workspace label and no results from tools the AI used.

Are you affected? What to do now

Most Notion users have nothing to do. Notion says it has contacted affected customers directly, and if you haven't been contacted, your workspace hasn't been identified as affected.

If you, or your workspace owner, received a notice:

• Review the affected data. According to BleepingComputer's reporting of Notion's guidance, workspace owners can do this through Security incident review in the Notion desktop or web app, and can share a link that lets members download their own transcripts. The emailed notice has the exact steps.
• Treat the transcripts as exposed. That is Notion's own wording.
• Rotate credentials. Change any passwords, API keys or tokens that people pasted into Notion AI. The advisory says "during the incident timeframe" but does not define that window, so if in doubt, rotate.
• Check what else was in the chats. Personal data, customer names or confidential plans pasted into AI chats may trigger internal reporting or, depending on content and contracts, privacy notification duties. Involve your privacy or legal team.
• Expect Insights to be unavailable. Notion has disabled it while it investigates.

For every organization, Notion user or not:

• Remind staff not to paste secrets into AI assistants. Chats can be stored, analysed and passed to subprocessors.
• Ask your SaaS vendors which AI providers process your data, and whether any of them were Fireworks customers.

The expert view

Timeline. From Notion's advisory: on the evening of November 2, Fireworks told Notion that a small dataset had been accessed; Notion later determined it held only synthetic Notion AI test data. On the morning of November 3, Notion cut off Fireworks, deleted its data there and stopped all communication with the vendor. On November 6, Fireworks reported that potential customer data may have been accessed, and on November 8 it confirmed the second dataset, the Insights transcripts. Notion published on November 9. Notion has also stopped serving open-weight models through Fireworks.

Zero data retention didn't cover this. Zero data retention (ZDR) means a provider processes a request and keeps nothing afterwards. Fireworks says its Inference, Training SDK and Nexus services are ZDR by default, and its November 9 bulletin reports no detected impact on them. BleepingComputer reports that Notion's FAQ says Fireworks had contractually committed to ZDR for Notion data. Yet a dataset of transcripts existed at Fireworks, because a classification workload needs stored input. VentureBeat notes that neither company has said which Fireworks feature held the data. The lesson is that a ZDR promise usually applies to live requests, while analytics, batch, evaluation and fine-tuning jobs keep data by design. A vendor review should ask about every data path, not just the headline inference API.

Fourth-party risk. Notion's customers had no contract with Fireworks, and Fireworks was breached through its own cloud provider. That makes three companies between a Notion user and the point of entry. Subprocessor lists exist to make this visible, but few customers read them, and fewer ask what each subprocessor stores.

Severity in context. There is no CVE because this is a breach, not a software flaw. The exposure is narrow: fewer than 1% of workspaces, mostly unattributable transcripts, one feature. Two things keep it from being trivial. First, chat transcripts are often more sensitive than the documents around them, because people paste credentials, customer data and drafts into AI assistants. Second, "unattributable" is not "anonymous". As Notion itself puts it, "Beyond what's in the chat transcript itself, there's no information tying the chat back to workspaces, users or companies" (quoted by SecurityWeek). A transcript that mentions a company name, a project or a person's email address can identify itself. Notion's advice to treat the data as exposed is the right one.

Motive. Fireworks links the activity to a financially motivated group that resells stolen access to AI models, consistent with the LLMjacking activity described by Google Threat Intelligence Group and Mandiant. Fireworks does not name the group, and nothing published so far shows that the attacker targeted Notion data specifically or used it.

Still unknown: how many Notion customers were notified, what period the transcripts cover, which Fireworks feature stored them, whether the data has been published or sold, and whether other Fireworks customers' end-user data was exposed in the same way. Both companies say their investigations are ongoing.

Official sources

• Notion — Security incident involving a third-party AI vendor (first published November 9, 2026)
• Fireworks AI — October 2026 Security Incident Update (last updated November 9, 2026)
• Google Threat Intelligence Group & Mandiant — LLMjacking: monetizing compromised cloud models
• Coverage: BleepingComputer — Notion says Fireworks breach exposed customer AI chat transcripts (November 11, 2026)
• Coverage: VentureBeat — Attackers breached the Fireworks AI storage where Notion AI chats sat outside zero data retention (November 11, 2026)
• Coverage: SecurityWeek — Notion customer data compromised in Fireworks AI hack (November 12, 2026)
• Coverage: AI Cyber Brief — Fireworks AI widens breach disclosure (November 10, 2026)