Notion Confirms AI Chat Transcripts Exposed in Fireworks AI Breach

Notion has confirmed that a cyberattack on its AI vendor Fireworks AI exposed chat transcripts from its Notion AI assistant, affecting fewer than 1% of Notion workspaces. The disclosure, published in a Notion security advisory first issued on November 9, 2026, makes Notion the first major consumer-facing company to say publicly that its users' data was caught up in the Fireworks breach.

The incident did not start at Notion. Attackers broke into Fireworks, a platform that runs open-weight AI models for other companies, by first compromising a third-party cloud provider that hosted Fireworks' research and development machines. From there, they reached Fireworks' development systems and, in the process, data belonging to some of Fireworks' customers — including a set of Notion AI chat transcripts.

What was exposed

Notion used Fireworks in two ways. Fireworks served some open-weight models inside Notion AI, and it also ran classification work for a feature called Insights, which shows workspace administrators how their teams use AI. To do that job, a set of Notion AI chat transcripts was stored and analysed at Fireworks — and that stored dataset is what the attackers reached.

According to Notion, the transcripts include any input to or output from the model that was written to the chat. For the vast majority of affected workspaces, however, the transcripts were unattributable: they carried no author name, no workspace label and no results from tools the AI used. Notion put it plainly in its advisory: beyond what is in the chat transcript itself, there is no information tying the chat back to workspaces, users or companies.

That does not make the exposure harmless. A transcript that mentions a company name, a project or a person's email address can identify itself, and people often paste passwords, API keys and confidential material into AI assistants. Notion's own advice is to treat the affected chats as exposed.

How the incident unfolded

Notion's advisory lays out a day-by-day account. On the evening of November 2, Fireworks told Notion that a small set of data had been accessed; Notion investigated and found it held only synthetic Notion AI test data. On the morning of November 3, Notion disconnected its systems from Fireworks, deleted the data stored there and stopped all connectivity between the two companies.

On November 6, Fireworks reported that potential customer data may have been accessed after all, and on November 8 it confirmed the final affected dataset. Analysis showed it included Notion AI chat transcripts used for the Insights feature. Notion published its advisory and began contacting affected customers on November 9.

The clean-up continued into this week. On November 11, Notion revoked Notion API keys it found inside affected messages, and on November 12 it reported exposed third-party API keys to the companies that issued them. Insights remains disabled while the investigation continues, and Notion says it no longer serves open-weight models through Fireworks.

The zero data retention problem

One detail in the disclosure has drawn particular attention. Fireworks had contractually committed to zero data retention for Notion's data — a promise that a provider processes a request and keeps nothing afterwards. Yet the transcripts existed in stored data at Fireworks, because the classification work for Insights needed stored input. Fireworks says its Inference, Training SDK and Nexus services are zero data retention by default and were not affected, but the stored Insights dataset sat outside that protection.

The lesson reaches well beyond Notion. A zero data retention promise usually covers live inference requests, while analytics, batch processing and evaluation jobs keep data by design. Companies that rely on AI vendors need to ask what happens on every data path, not just the headline API.

Who is behind the attack

Fireworks links the activity to a financially motivated group that resells stolen access to AI models, a scheme known as LLMjacking that Google's Threat Intelligence Group and Mandiant have warned about. Fireworks has not named the group, and nothing published so far shows that the attackers targeted Notion's data specifically or used it. Fireworks said in its November 9 security update that the attackers also took customer billing information, such as addresses and invoice history — but not payment card numbers — and, for some customers, parts of datasets and incomplete model weights. Fireworks has brought in Palo Alto Networks Unit 42 to help with the investigation.

What Notion users should do

Most Notion users have nothing to do. Notion says it has contacted affected customers directly, and if neither you nor your workspace owner received a notice, your workspace has not been identified as affected.

If you did receive a notice, workspace owners can review the affected data through Security incident review in the Notion desktop or web app, and share a link that lets members download their own transcripts. Treat anything typed into Notion AI during the incident window as exposed, and rotate any passwords, API keys or other credentials that were pasted into those chats. Notion has already revoked the Notion API keys it found, but third-party keys need rotating by their owners.

For every organisation, the incident is a reminder not to paste secrets into AI assistants: chats can be stored, analysed and passed to subprocessors. It is also worth asking software vendors which AI providers process their data — and whether any of them were Fireworks customers. Fireworks serves tens of thousands of customers, and Notion is so far the only one to confirm publicly that its users' content was involved.

Several questions remain open: how many customers were notified, what period the transcripts cover, whether the stolen data has been published or sold, and whether other Fireworks customers' end-user data was exposed in the same way. Both companies say their investigations are ongoing.

Sources

• Notion — Security incident involving a third-party AI vendor (first published November 9, 2026): https://www.notion.com/security/advisories/security-incident-involving-a-third-party-ai-vendor-nov9
• TechCrunch — Cyberattack on Fireworks AI allowed hackers to access Notion customers' chat transcripts (November 12, 2026): https://techcrunch.com/2026/11/12/cyberattack-on-fireworks-ai-allowed-hackers-to-access-notion-customers-chat-transcripts/
• BleepingComputer — Notion says Fireworks breach exposed customer AI chat transcripts (November 11, 2026)
• SecurityWeek — Notion customer data compromised in Fireworks AI hack (November 12, 2026)
• AI Cyber Brief — Notion: Fireworks AI breach exposed Notion AI chat transcripts from under 1% of workspaces (November 13, 2026): https://aicyberbrief.com/article/notion-fireworks-ai-breach-exposed-notion-ai-chat-transcripts-from-under-1-of-workspaces
• Notebookcheck — Notion AI chats exposed in breach at AI provider Fireworks (November 12, 2026): https://www.notebookcheck.net/Notion-AI-chats-exposed-in-breach-at-AI-provider-Fireworks.1448673.0.html