Notion AI Chat Data Exposed After Fireworks AI Security Breach
Notion has informed a small number of customers that some Notion AI chat transcripts were exposed during a security incident involving Fireworks AI, one of the company’s third-party AI infrastructure providers.
According to Notion, the incident impacted fewer than 1% of workspaces. The exposed information came from Notion AI conversations that had been sent to Fireworks for use with Insights, a feature designed to help organizations understand how AI is being used across their workspace.
What information was exposed?
The exposed data included Notion AI chat transcripts processed through Fireworks. In most affected cases, Notion says the transcripts were “unattributable,” meaning they were not directly labeled with the user who wrote them or the workspace they came from.
However, the transcripts may still contain the actual prompts and messages typed by users. That means any sensitive information entered into Notion AI, such as passwords, internal business details, API keys, or confidential notes, should be treated as potentially exposed.
Notion also stated that tool call results were not included in the exposed transcripts. During its investigation, the company found Notion API keys in some affected messages and revoked those keys on November 11 as a precaution.
How the Notion AI breach unfolded
The incident began when Fireworks alerted Notion on November 2 about a dataset that initially appeared to contain only synthetic test data. By the morning of November 3, Notion had disconnected its systems from Fireworks and removed its data from the vendor’s environment.
On November 6, Fireworks informed Notion that customer data may have been accessed. Two days later, on November 8, Fireworks confirmed that the final exposed dataset included real customer AI chats. Notion started notifying impacted customers on November 9.
Notion has since disabled the affected Insights functionality while the investigation continues. The company also said it no longer uses Fireworks to serve open-weight AI models.
How attackers accessed Fireworks AI systems
Fireworks said the attack was connected to a security incident at a third-party cloud provider that hosted its research and development systems. The breach reportedly began on October 23, and by October 24 the attacker had used that access to reach Fireworks development machines and run an unauthorized workload.
The stolen data reportedly included resource metadata, billing information, and, for some customers, partial datasets and incomplete model weights. Fireworks said it does not store payment card numbers.
The company also disclosed that an earlier intrusion in October had exposed stored secrets, including API keys.
Fireworks has linked the attack to a financially motivated group involved in selling unauthorized access to large language models. This type of activity is often called LLMjacking, where attackers steal or abuse access to AI systems and resell it for profit.
What Notion users should do now
If you have not received a notification from Notion and your workspace owner has not been contacted, Notion says no action is currently required.
For affected workspaces, owners can review details in Notion’s web interface under the security incident review section. Workspace members may also be given access to download their own exposed transcripts.
Notion recommends treating any affected AI chat data as exposed. Users should immediately rotate any credentials that may have been pasted into Notion AI, including:
Passwords
API keys
Authentication tokens
Private access links
Internal system credentials
Sensitive business or customer information
Even if the leaked transcripts were not directly tied to a user or workspace in most cases, the content of the messages themselves may still reveal confidential details.
Why this breach matters for AI users
This incident highlights a growing security concern for businesses and individuals using AI tools inside productivity platforms. When users type information into an AI assistant, that data may be processed by external providers, also known as subprocessors.
In this case, Notion AI chats were sent to Fireworks for AI-related processing. Once data leaves the original platform and enters a vendor environment, it can become exposed if that vendor suffers a breach.
The Notion AI incident is another reminder that users should avoid entering highly sensitive credentials, secrets, or private company data into AI chat tools unless they fully understand how that data is stored, processed, and protected.
For companies using AI in daily workflows, this breach is a signal to review vendor risk, data retention policies, AI logging practices, and internal rules for what employees can safely share with AI assistants.
