Key Takeaways
- Fireworks AI Breach: An October breach at Fireworks AI exposed Notion AI chat transcripts processed for Insights. Notion reported no breach of its own systems, paused Insights and stopped serving open-weight models through Fireworks.
- Chats and Notices: Notion emailed affected customers on Nov 9 and says fewer than 1% of workspaces were affected. The exposed Notion AI transcripts contained no tool call results, and most affected workspaces had chats without author or workspace labels, though the text can still identify you.
- Review and Rotate: If Notion contacted your workspace, review the affected chats inside Notion, rotate any passwords, API keys or tokens you pasted during the incident period, and watch for phishing. Notion says no action is needed right now if your workspace received no notice.
If you’ve ever pasted a password or API key into Notion AI, check whether your workspace received a security notice. The Notion data breach exposed AI chat transcripts that Fireworks AI processed for Notion’s Insights feature, affecting fewer than 1% of workspaces. Notion emailed affected customers on Nov 9 and advised them to rotate any credentials they pasted into Notion AI during the incident period.
The breach happened at Fireworks AI, a vendor Notion used to run some of its AI jobs. If your workspace received an email, you can follow its instructions to review the affected chats securely inside Notion. Keep an eye on what you typed into the conversation itself. A transcript can still contain your name or a client’s details even when it carries no author label.
| Detail | What we know |
|---|---|
| What leaked | Notion AI chat transcripts processed for Insights |
| Who was affected | Fewer than 1% of Notion workspaces |
| Where the breach happened | Fireworks AI, a third-party AI inference vendor |
| Key dates | Nov 2 first alert, Nov 8 dataset confirmed, Nov 9 customers emailed |
| Notion’s own systems | Notion reports no breach of its own systems |
| What’s paused | Insights is disabled, and Notion has stopped serving open-weight models through Fireworks |
| What to do | Rotate any credentials you pasted into Notion AI during the incident period |
What Happened in the Notion Data Breach
Fireworks AI did two jobs for Notion. It classified AI conversations for Insights, which helps workspace owners understand how their teams use Notion AI. Fireworks also ran open-weight models that you could use inside Notion. You can read the full timeline in Notion’s security advisory.
When Fireworks first alerted Notion on Nov 2, Notion’s review turned up only synthetic data created for testing. Notion cut ties with the vendor the next day, and a second alert on Nov 6 led it to reopen the investigation. Here’s how the two companies’ timelines fit together.
| Date | Event |
|---|---|
| Oct 6 | Fireworks detected unauthorized use of its internal credentials. |
| Oct 23-24 | A security incident at a cloud provider on Oct 23 gave an attacker a way into Fireworks development machines the next day. |
| Nov 2 | Fireworks alerted Notion, whose first review found only synthetic Notion AI test data. |
| Nov 3 | Notion disconnected from Fireworks, deleted its data from the vendor’s systems and blocked communication between the two companies’ systems. |
| Nov 6 | Fireworks warned that customer data might have been accessed, and Notion opened a new investigation. |
| Nov 8 | Fireworks confirmed that the affected dataset included Notion AI chats processed for Insights. |
| Nov 9 | Notion emailed affected customers. |
| Nov 10-11 | Notion updated its security advisory. It said the Nov 10 edits clarified the wording and left the facts as stated. |
The Fireworks breach is separate from the July 2026 claim involving 110 million records, which Notion said was fabricated, and the April 2026 report about email addresses exposed through public Notion pages.
What Data Was Exposed and What Wasn’t
If you use Notion for team documents as well as AI chats, how far did the exposure reach? Notion identified transcripts processed for Insights, while Fireworks reported several other types of data across its own customer base. For your workspace, start with the details Notion confirmed.
Confirmed as Exposed
- AI chat transcripts. The affected dataset included conversations Fireworks processed for Notion AI Insights.
- Conversation text. For most affected workspaces, the transcripts carried neither author nor workspace labels. The words you typed could still contain identifying details.
Not Affected, According to Notion
- Tool call results. The exposed transcripts contained no results from tools that Notion AI called during a chat.
- Other Notion features. Notion says the exposure was limited to transcripts processed for Insights.
- Notion’s own systems. Notion reports no intrusion into its own infrastructure.
Fireworks reported exposure of billing information and incomplete model weights across its customer base. Notion’s advisory identifies only Insights transcripts for its workspaces. Notion hasn’t published the date range of the chats or the exact number of workspaces affected, and whether anyone misused or published the transcripts remains unknown.
How Fireworks AI Was Breached
Fireworks described two intrusions in October. The first involved misuse of internal credentials, and the second began at a cloud provider that hosted Fireworks development machines. The public accounts leave one question open for you as a Notion user. Which intrusion exposed the chats? AI vendors and tools have been popular targets lately, as the recent AI agent hacking spree showed.
The October Credential Theft
On Oct 6, Fireworks detected someone using its internal credentials without authorization. The attacker accessed environment variables used in evaluation jobs for a limited number of customer accounts. Those variables included secrets such as API keys and tokens.
The Cloud Provider Break-In
A security incident on Oct 23 hit the outside cloud provider that hosted Fireworks’ research and development machines. A day later, the attacker got into Fireworks’ development machines through the cloud provider and ran a workload without permission. Fireworks detected it that day.
Fireworks reported exposure of resource metadata, billing details such as addresses and invoices, and some customer datasets and incomplete model weights. Fireworks says it doesn’t store payment card numbers, which were unaffected.
Who Was Behind It
Fireworks says the evidence points to an unnamed group that makes money by selling stolen AI access tokens to illicit services that route AI requests. That practice is called LLMjacking. Fireworks CEO Lin Qiao said, “From what we see attackers are not after weights.”
Fireworks notified law enforcement and brought in Palo Alto Networks Unit 42. The Record reported that Fireworks has more than 10,000 customers, and Fireworks hasn’t disclosed how many were affected. Bloomberg reported that Fireworks was working with Cursor and Harvey to assess the impact, though their involvement remains unconfirmed.
How to Tell If Your Workspace Was Affected
Notion says there’s no action you need to take right now if it hasn’t contacted your workspace. The notices went out by email, so if you’re unsure whether one arrived, start with the people who manage your workspace.
- Search the inboxes of every workspace owner and admin for a Notion security email dated Nov 9 or later. Check spam folders too.
- Check the sender’s full email address before clicking anything. Make sure it uses a genuine Notion domain, since a fake breach notice can be a phishing attempt.
- Follow the instructions in the original, verified email to review the affected chats inside your workspace. Avoid opening a link from a forwarded copy.
- If you’re a workspace member, ask your owner whether they received a notice.
- Save Notion’s security advisory so you can check for updates. Notion says it will contact any additional workspaces it finds were affected.
According to The Register, Render founder and CEO Anurag Goel made public the Notion email his company received. The notice said some of Render’s Notion AI chats may have been exposed.
What to Do If Notion Contacted You
If Notion emailed your workspace, follow the instructions in the original notice to review the affected chats inside Notion. What should you look for once you’re there? Start with anything someone could use to access an account or learn something private about your team or clients. For a similar cleanup, see what to do if mSecure told you to change your passwords.
Review the Exposed Transcripts
- Open the secure review inside your workspace using the instructions in Notion’s email. Read the affected conversations and treat what you find as if it were public.
- Note any names, client details, internal URLs, passwords, API keys or tokens in the chat text. Pay attention to what you pasted into the conversation, even if the transcript carries no author or workspace label.
Rotate API Keys, Tokens and Passwords
- List each credential you found and identify where it came from. That could be a cloud provider, a payment service, a code host or another account you use for work.
- Revoke exposed keys and tokens with the service that issued them, then create replacements. If you pasted a password, change it on the account where you use it. Deleting a stored copy of a credential leaves the credential itself valid, according to Fireworks.
- Update the apps and services that relied on the old credentials so they can use the replacements.
- Check the issuing service’s access logs for activity you don’t recognize.
Watch for Follow-Up Phishing
- Fake Notion notices. Be wary of messages that claim to offer another way to view your exposed chats. Use the instructions in the verified notice your workspace received.
- Password reset requests. If a message asks you to reset a password, open the service yourself and change it there.
- Familiar details. A message that names a client or project from a chat can sound convincing. Verify who sent it before you act on the request.
Why Unlabeled Chats Can Still Identify You
Most affected workspaces had transcripts without author or workspace labels. As Reddit users pointed out in comments covered by The Register, and as Cyber Security News noted, the conversation itself can still tell someone who wrote it or where they work. Think about what someone could infer from details like these.
- Your name. You ask Notion AI to draft a reply and give it your full name to sign off.
- Your company name. You paste a paragraph from an internal document that names your employer.
- A project codename. You include an internal project name when asking for a summary.
- An email signature. You paste a message that ends with your name, role and work email.
- Customer details. You ask for help with a support reply and paste the customer’s name and account information.
How Notion AI Handles Your Data by Plan
How long can an AI provider keep what you type? The answer depends on your Notion plan and, on Enterprise, which models your workspace owner has enabled. Notion’s published rules cover provider retention and model training.
| Plan | Provider data retention | Used for training |
|---|---|---|
| Enterprise | Most models have zero data retention. Data-retaining models stay disabled unless your workspace owner chooses to enable them. | No |
| Free, Plus and Business | The AI provider keeps data for up to 30 days before deleting it. | No, by default |
If you own a Business or Enterprise workspace, you can use the Controls tab for Notion AI to choose the providers and models available for Notion Agent and Custom Agents. The Insights tab is paused, so you can’t see use cases or conversation counts there right now.
How to Keep Secrets Out of AI Chat Tools
The same habits apply whether you use Notion AI, ChatGPT, Claude or Copilot. Before you send a message, check what the tool actually needs to answer your question. You can often get help with a task after removing names and credentials from what you paste. The same habits apply to ChatGPT too, and our look at ChatGPT safety explains what to watch for.
For Everyday Users
- Leave out live credentials. Use a placeholder if your question involves a password, API key or token.
- Remove client names. Replace names with generic labels before asking for help with a client email or document.
- Share secrets in a password manager. Use it when a teammate needs access to a credential.
- Choose short-lived tokens. When your work requires a token, prefer one that expires soon.
For Workspace Owners and Admins
- Review the AI subprocessor list. Check which vendors can process your workspace’s AI data.
- Limit model providers. Use the Controls tab, where available, to choose which providers your team can use.
- Set a policy for AI use. Tell your team what they can paste into chats and where to share credentials.
- Scan exported pages. Run a tool that looks for passwords, API keys and other secrets in your exports.
- Practice your response to a vendor breach. Decide who checks for notices, reviews affected data and replaces credentials.
What Happens Next for Notion and Fireworks
Notion and Fireworks are still investigating, and Notion AI Insights remains paused. Notion says it will email more workspaces directly if it finds that their chats were affected.
For now, check your email or ask your workspace owner to check theirs. If Notion contacted you, review the affected chats and replace any credentials you pasted during the incident period. Next time you open an AI chat, share only what you’d be comfortable with someone else reading. And if Notion itself starts acting up, here’s how to fix Notion when it won’t sync.
FAQs
No. Notion says the breach happened at Fireworks AI, the vendor that processed chat transcripts for its Insights feature.
Notion says the exposure affected fewer than 1% of its workspaces. The company hasn’t given an exact workspace count or said how many individual users were affected.
Notion says no action is needed right now if your workspace received no notice. If you’ve pasted your Notion password or any other live credential into an AI chat, change it with the service that issued it.
Yes, someone could identify you from what you typed. Most affected workspaces had transcripts without author or workspace labels, but the chat text itself can include details such as your email address, company name or a client’s name.
Notion hasn’t announced a date for Insights to return. The feature is paused while Notion investigates the breach.
Under the default policy, Notion and its AI providers exclude your customer data from model training. How long a provider keeps your data depends on your plan and which models you use.
