Notion AI data exposure: chat transcripts caught in Fireworks AI breach

Notion has confirmed that a security incident at Fireworks AI, one of its artificial intelligence vendors, exposed some Notion AI chat transcripts. In a security advisory first published on 9 November 2026 and updated on 12 November, the company says the incident affects fewer than 1% of Notion workspaces, that its own systems were not breached, and that it has disconnected from Fireworks.

The Notion AI data exposure matters beyond the customers involved. It shows how business conversations typed into an AI assistant can end up stored at a supplier most users have never heard of.

What happened, and when?

According to the current version of Notion's advisory, the timeline runs as follows:

• 2 November 2026: Fireworks AI told Notion that malicious actors had accessed a small set of data. At that stage, Notion says, the dataset contained Notion AI synthetic testing data and no customer data.
• 3 November: Notion disconnected its systems from Fireworks.
• 4 November: Notion deleted all its data in the Fireworks system.
• 6 November: Fireworks notified Notion that customer data may have been accessed.
• 8 November: Fireworks confirmed the final affected dataset, which included Notion AI chat transcripts.
• 9 November: Notion contacted the customers it had identified as affected.
• 11 November: Notion revoked exposed Notion API keys that it found in affected user messages.
• 12 November: Notion reported exposed third-party API keys found in affected messages to the vendors that issued them. An update entry added to the advisory on 13 November repeats this and says Notion will contact any customer whose workspace is later found to be affected.

Fireworks AI has published its own account. In a security bulletin last updated on 9 November 2026, it says a third-party cloud provider that hosted Fireworks research and development machines suffered a security incident on 23 October, and that an unauthorised party used it the next day to reach Fireworks development machines.

Fireworks says that, for certain customers, a subset of incomplete model weights and datasets were accessed. Its bulletin does not name Notion or any other customer.

What data was exposed?

Notion says the affected material is Notion AI chat transcripts that were used for Insights, a feature that helps customers understand their own AI usage. Fireworks ran the classification jobs behind that feature.

A transcript is broad by nature. Notion's help page on the incident says any input to or output from the model that was written to the chat is included. In practice that means whatever a person typed or pasted into the assistant, and what it wrote back.

What does "unattributable" mean?

Notion says that for the vast majority of affected workspaces the transcripts were unattributable. Its advisory defines that as chats that "weren't labeled with who wrote them or which workspace they came from".

That is a claim about labels, not about content. If someone pasted a customer name, a product plan or a password into a chat, that text is still in the transcript. Notion's wording also covers only "the vast majority" of affected workspaces, not all of them.

What was not exposed, according to Notion?

• Notion states that this "was not a breach of our systems".
• The transcripts did not contain tool call results, the advisory says.
• AI Meeting Notes data was not affected unless it was used as an input in a Notion AI chat, according to the help page.
• Notion says no other features were affected, while noting that its investigation continues.

How many customers are affected?

Notion gives a proportion, not a number: fewer than 1% of workspaces. SecurityWeek reported on 12 November that the company is notifying a small set of customers and has not said how many.

Notion has not published the dates covered by the exposed chats either. Both of its pages refer only to the timeframe of the incident.

If you have not heard from Notion, its advisory says it has not identified your workspace as affected and no action is needed for now.

What have Notion and Fireworks done?

Notion says it has:

• cut the connection to Fireworks and deleted its data there
• disabled the Insights feature while it investigates
• stopped serving open-weight models through Fireworks, and halted all training runs
• revoked Notion API keys found in the affected messages
• begun an audit of critical vendors, covering data minimisation and zero data retention practices

Fireworks says it revoked and replaced credentials and service accounts, notified law enforcement and brought in Palo Alto Networks Unit 42. It has also disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training while the investigation continues.

Fireworks describes the activity as financially motivated and aimed at selling tokens from unauthorised access to large language models. It says its investigation is ongoing and may reveal more.

What should affected workspace owners do?

Notion's guidance is direct: treat the data as if it were exposed. Its help page sets out the steps.

1. Open the review tool. In the workspace sidebar, select the question mark menu and choose Security incident review. Notion says to use a desktop browser, as the data is not accessible on mobile.
2. Download the list of affected members. Owners can also copy a link that gives each member a file containing only their own affected data.
3. Read the affected content. The files showing the exposed chat text are only available to workspaces with a verified domain.
4. Rotate credentials straight away. If anyone pasted passwords, API keys or other credentials into Notion AI during the incident timeframe, Notion recommends rotating them right away.

Rotation should happen at the service that issued the credential, not only inside Notion. A key deleted from a chat is still valid until its issuer revokes it. Our guide to cybersecurity challenges and solutions covers credential hygiene in more detail.

Why did a "zero data retention" promise not prevent this?

This is the least comfortable detail in Notion's disclosure. The help page says Fireworks gave Notion a contractual commitment to zero data retention, yet data was retained from the Fireworks endpoints that Notion used.

Notion also explains that its own Enterprise zero data retention setting applies to the API requests it sends to third-party model vendors. It does not cover features that have to store data to work, such as chat history and Insights.

BleepingComputer notes that an earlier, separate Fireworks breach in early October exposed environment variables holding API keys and tokens for a limited number of accounts. VentureBeat reports that neither company has said which Fireworks feature stored the Notion transcripts.

Fireworks, for its part, says that so far it has detected no impact on its Inference, Training SDK and Nexus products, which it describes as zero data retention by default.

Analysis: the lesson about third-party AI processors

The following is our analysis, not a statement from either company.

First, an AI feature is rarely one company's product. A workspace tool may route prompts to several model providers, and each one is another place where data can sit. Anyone using generative AI at work is trusting that whole chain, not just the brand on the login page.

Second, "zero data retention" is a narrower phrase than it sounds. On Notion's own account, it applied to live requests but not to stored features, and a contractual promise from a vendor did not match what happened. Buyers should ask which features store content, where, and for how long.

Third, chat boxes attract secrets. Notion found exposed Notion API keys in the affected messages and revoked them. Organisations would do well to treat AI chats like email: assume the text may be read elsewhere one day, and keep credentials out of it.

None of this suggests that Notion customers outside the affected group are at risk from this incident. It does suggest that vendor lists and data-processing terms deserve a closer read than they usually get.

Sources

• Notion security advisory: Fireworks AI incident (current version)
• Notion security advisory: original version of 9 November 2026
• Notion help centre: security incident involving a third-party AI vendor
• Fireworks AI: update on October 2026 security incident
• BleepingComputer: Notion says Fireworks breach exposed customer AI chat transcripts
• SecurityWeek: Notion customer data compromised in Fireworks AI hack
• VentureBeat: Attackers breached the Fireworks AI storage where Notion AI chats sat outside zero data retention