Notion says a breach at Fireworks AI, one of its inference providers, exposed Notion AI chat transcripts from fewer than 1% of Notion workspaces. Fireworks notified Notion of the incident, and Notion says it has contacted the affected customers.
The exposed data is the Notion AI chat transcripts Notion sent to Fireworks. Notion said any input to or output from the model that was written to the chat is included in those transcripts. Notion used Fireworks for classification jobs behind Insights, the admin feature that shows how members use AI, and as a general inference provider for open-weight models. Data from volunteers in its LEAP program was also used to experiment with training task-specific models on Fireworks.
Fireworks had a contractual zero data retention commitment covering Notion's use. Notion said its investigation found that data was retained from the Fireworks endpoints it used anyway.
Key facts
- 01Fireworks AI told Notion a security incident affected fewer than 1% of Notion workspaces.
- 02Exposed data includes Notion AI chat transcripts sent to Fireworks, including model inputs and outputs.
- 03Notion disconnected from Fireworks and deleted its data there as of November 3, 2026.
- 04Notion says Fireworks retained data despite a contractual zero data retention commitment.
- 05Attackers reached Fireworks through its cloud provider, compromised October 23, in its second incident since October 6.
Notion said that as of November 3 it had disconnected its systems from Fireworks, deleted all data in the Fireworks system, and stopped sending data and traffic there. It halted training runs, disabled Insights during the investigation, stopped serving open-weight models through Fireworks, and began auditing critical vendors, including inference providers and data processors, for zero data retention compliance.
For most affected workspaces, Notion said it did not add metadata that attributes a transcript to a specific workspace, user, or company. Audio, transcripts, and summaries from AI Meeting Notes were not affected unless they were used as input to a Notion AI chat.
Workspace owners can review the incident from the help menu in the Notion sidebar on a desktop browser, download a list of affected members, and share a link with them. Files showing the affected content are available only to workspaces with a verified domain. Notion recommends treating the data as exposed and rotating any passwords, API keys, or credentials pasted into Notion AI during the affected period.
On the Fireworks side, the third-party cloud provider hosting its research and development machines was compromised on October 23, and attackers used that access the next day to reach Fireworks development systems. Fireworks said the data taken included resource metadata, billing information such as addresses and invoice histories, and for certain customers a subset of incomplete model weights and datasets. Payment card numbers were not stored. Fireworks CEO Lin Qiao said attackers did not appear to be after model weights.
“Most downloads were partial and stopped.”— Lin Qiao, Fireworks co-founder and CEO
This is the second Fireworks incident in two months. The company detected unauthorized use of internal credentials on October 6 and disclosed it on October 9. Fireworks believes the attackers are financially motivated and focused on reselling access to large language models, and it has worked with Palo Alto Networks' Unit 42 to rotate credentials and isolate affected systems. Fireworks has tens of thousands of customers, including Cursor and Harvey.
Notion said its investigation is ongoing. If neither a user nor the workspace owner has heard from Notion, the company said it has not identified that workspace as affected and no action is needed.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
