Notion AI chat transcripts exposed in Fireworks AI breach

Notion says a breach at its AI inference provider Fireworks AI exposed some customers' Notion AI chat transcripts, and has disabled the dataset involved. Notion puts the impact at less than 1% of users, limited to a small number of workspaces. There is no public advisory page to link as a primary; this is based on Fireworks' own breach disclosure and Notion's customer notice, as reported by BleepingComputer and corroborated by reporting on Fireworks' expanded disclosure.

What happened

Fireworks AI runs some open-weight models that power Notion AI, and analyzed stored conversations for Notion's Insights feature. Fireworks confirmed an attacker reached its development environment through a third-party cloud provider on 23 October 2026, accessing resource metadata, billing information, model weights and datasets for some customers. A separate, earlier intrusion in early October exposed environment variables containing API keys and tokens for a limited number of accounts.

The Notion data caught up in this was chat transcripts from the Insights dataset. Per Notion, most affected chats were "unattributable" — not labeled with an author or workspace — and the transcripts did not contain tool-call results. Notion's FAQ notes Fireworks had contractually committed to zero data retention for Notion data, which the exposure contradicts.

Timeline

• 2 November 2026 — Fireworks alerts Notion to an exposed dataset that, at first, appeared to hold only synthetic test data.
• By 3 November — Notion cuts traffic to Fireworks, deletes its data from the vendor's systems, and halts training runs.
• 8 November — Fireworks confirms customer data was accessed, including Notion users' data. Notion analyzes the dataset it received and finds the chat transcripts.
• 11 November — the incident is reported publicly.

Action checklist

1. Workspace owners: open Security incident review in the Notion desktop or web app to see whether your workspace is flagged. From there you can share a link that lets members download their own affected transcripts.
2. Rotate anything you typed into Notion AI. If a user pasted a password, API key or other secret into an affected chat, treat it as exposed and rotate it. Chat transcripts are exactly where credentials end up.
3. No notice, no action — for now. Notion says users who weren't notified by Notion or their workspace owner are most likely not in the impacted set.
4. Review your own model-inference vendors. If you ship a feature backed by a third-party inference API, confirm what prompt and output data they retain, and whether a "zero retention" clause is actually enforced technically rather than just contractually.

Context

This is the AI supply chain producing the same breach shape we keep logging: the sensitive data isn't lost by the brand-name vendor but by a downstream provider it fanned data out to. We saw it when a Northflank breach put AI API keys at risk and in the Chainalysis agentic-platform incident. The twist here is the data type: LLM chat transcripts are a uniquely toxic thing to leak, because users treat an AI box like a private scratchpad and paste secrets, internal docs and PII into it. A "zero data retention" promise is only as good as the vendor's weakest development environment — and here that environment was reachable through a third-party cloud the customer never chose.