Notion has told customers that a security breach at its artificial intelligence vendor, Fireworks AI, exposed some Notion AI chat transcripts. Fewer than 1% of Notion workspaces are affected, according to the company, and Notion stresses that its own systems were not breached.

The disclosure, published in a Notion security advisory and reported on 11 November, is the first product-specific account of what was inside the data taken in the Fireworks incident — and it is a reminder that the private conversations people have with an AI assistant can end up stored in places they never agreed to.

How the exposure unfolded

Fireworks AI is an AI infrastructure provider that runs models for tens of thousands of customers. Notion used it in two ways: to run classification jobs for a feature called Insights, which helps workspace administrators understand how their teams use AI, and as a general inference provider to serve open-weight models inside Notion.

The incident itself began outside Fireworks. On 23 October, an attacker got into a third-party cloud provider that hosts Fireworks machines and from there reached Fireworks' development machines, running an unauthorised workload. Fireworks says the intrusion exposed resource metadata, billing information and, for some customers, portions of datasets and unfinished model weights. It notified law enforcement and brought in Palo Alto Networks' Unit 42 to investigate.

Notion's timeline starts on the evening of 2 November, when Fireworks told it a small set of data had been accessed. Notion investigated and concluded the dataset appeared to hold only Notion AI synthetic testing data, with no customer data involved. As a precaution, by the morning of 3 November Notion had disconnected its systems from Fireworks, deleted all its data in the Fireworks system and stopped all communication between the two systems.

On 6 November, Fireworks told Notion that malicious actors may have accessed potential customer data. Notion began a second investigation, and on 8 November Fireworks confirmed a new dataset. When Notion analysed it, the company found it included Notion AI chat transcripts used for the Insights feature. Notion contacted affected customers on 9 November.

What was exposed — and what was not

The exposed material was chat text: the prompts people typed into Notion AI and the replies the AI gave, as stored for the Insights feature. For the vast majority of affected workspaces, Notion describes the transcripts as unattributable — they were not labelled with who wrote them or which workspace they came from, and they did not contain tool call results, such as page content or outside data pulled in by Notion AI.

That limit matters, but it is not a guarantee of anonymity. As Notion itself notes, beyond what is in the chat transcript itself there is nothing tying a chat back to a workspace — but the words in a chat can still name people, projects or clients. No other Notion features were affected, and no other workspace data, such as pages, databases or files, was part of the incident.

Notion says Fireworks had given it a contractual commitment to zero data retention for its data — and that during the investigation it learned data had in fact been retained from the Fireworks endpoints it used. The Insights feature has now been disabled while Notion investigates, and the company says it is no longer serving open-weight models through Fireworks.

What affected users should do

Notion has contacted the owners of affected workspaces directly. If you have not heard from Notion, the company says your workspace has not been identified as affected and no action is needed right now. Affected workspace owners can review the implicated data securely inside their workspace, using instructions sent by email, and share a link so members can download their own transcripts.

Notion advises affected customers to treat the data as if it were exposed. Anyone who pasted passwords, API keys or other credentials into Notion AI during the period of the incident should rotate them now. Notion says its investigation is ongoing and it will contact more customers if it finds further exposure.

The incident is Fireworks' second in a matter of weeks. An earlier breach in early October saw attackers access environment variables containing API keys and tokens stored as secrets for a limited number of accounts. For Notion users, the lesson is a practical one: anything typed into an AI chat — including secrets, client details and commercially sensitive plans — should be treated as data that could leave the building.

Sources: Notion security advisory and BleepingComputer.