Pull to refresh
Logo
What Changed
Following Why Sign Up
Fireworks AI breach exposes Notion AI chat transcripts

Fireworks AI breach exposes Notion AI chat transcripts

Force in Play

Attackers reached a third-party AI vendor's development systems, exposing conversations from Notion's Insights feature for under 1% of workspaces.

Today: Notion confirms breach publicly

Overview

Updated 1 hour ago

Notion confirmed on November 12 that hackers accessed chat transcripts from its AI assistant after breaking into systems at Fireworks AI, the vendor that ran part of Notion's AI infrastructure. The exposed data covers fewer than 1% of Notion workspaces and includes conversations from Insights, a feature that tracks how customers use Notion AI.

The breach shows how a security failure at one AI vendor can reach companies that never dealt with it directly. Notion cut its connection to Fireworks on November 3 and deleted its data there, but transcripts had been stored on Fireworks systems outside the vendor's default no-retention policy.

Why it matters

If your company sends documents or credentials through a third-party AI model, that vendor's storage practices become part of your security perimeter.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

<1%
Share of Notion workspaces affected
Notion says fewer than 1% of its workspaces had data in the exposed dataset.
10,000+
Fireworks AI customers
Fireworks sells inference capacity to more than 10,000 customers, including Notion, Cursor, and Harvey.
2
Fireworks breaches disclosed in weeks
Fireworks disclosed a second security incident in October 2026 after an earlier bulletin.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

LQ
Lin Qiao
Chief executive, Fireworks AI
Leading Fireworks' incident response

Organizations Involved

Fireworks AI
Fireworks AI
AI infrastructure provider
Investigating October breach; notifying affected customers

Fireworks AI sells inference capacity for open-weight AI models and counts Notion, Cursor, and Harvey among its customers.
NO
Notion
Productivity software company
Disconnected from Fireworks; notifying affected customers

Notion makes workspace and productivity software, including an AI assistant used by its customers.
UN
Unit 42
Threat research unit
Hired by Fireworks to investigate

Palo Alto Networks' threat intelligence and incident response unit.
Cursor
Cursor
AI developer
Fireworks customer; not confirmed affected

Cursor makes an AI-assisted code editor and is a Fireworks customer.
Harvey
Harvey
Legal AI company
Fireworks customer; not confirmed affected

Harvey makes AI tools for law firms and is a Fireworks customer.

Timeline

October 2026 November 2026

10 events Latest: Today
Tap a bar to jump to that date

  1. Notion confirms breach publicly

    Today Disclosure

    Notion says hackers accessed AI chat transcripts for under 1% of workspaces.

  2. Notion revokes exposed API keys

    Response

    Notion revokes Notion API keys found in affected user messages.

  3. Notion contacts affected customers

    Notification

    Notion reaches out to workspaces tied to the exposed transcripts.

  4. Fireworks confirms final impacted dataset

    Investigation

    The dataset includes Notion AI chat transcripts from the Insights feature.

  5. Fireworks warns of possible customer data exposure

    Notification

    Fireworks tells Notion malicious actors may have accessed customer data.

  6. Notion cuts ties with Fireworks

    Response

    Notion disconnects its systems, deletes data in Fireworks, and stops communication.

  7. Fireworks tells Notion data was accessed

    Notification

    Fireworks says a small set of data was taken; Notion begins investigating.

  8. Attackers reach Fireworks development machines

    Incident

    Intruders run an unauthorized workload; Fireworks detects and remediates the same day.

  9. Cloud provider hosting Fireworks R&D machines breached

    Incident

    A third-party cloud provider used for Fireworks research machines is compromised.

  10. Fireworks publishes first breach bulletin

    Disclosure

    Fireworks discloses that stored secrets used in evaluation jobs were accessed.

Scenarios

1

No further misuse surfaces as Notion rotates credentials

Likely Resolves by Feb 28, 2027

Discussed by: Notion's security advisory and its customer guidance

Notion has told affected customers to treat the transcripts as exposed and rotate any passwords or API keys pasted into Notion AI. If no additional access or misuse appears, the incident closes as a contained vendor breach.

2

Another Fireworks customer discloses exposed data

Possible Resolves by Jan 31, 2027

Discussed by: Bloomberg Law and Fireworks' customer communications

Fireworks says it is working with Notion, Cursor, and other customers. If the forensic review finds that another named customer's datasets or transcripts were in the exposed set, that company would have to notify its own users.

3

Regulator opens inquiry into AI vendor data retention

Unlikely Resolves by Q2 2027

Discussed by: No regulator has commented publicly

The breach exposed data that Fireworks' default no-retention policy was supposed to keep out of storage. A regulator could ask whether the policy was accurately described to customers, or whether Notion's contract terms were followed.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

December 2020

SolarWinds supply chain breach (2020)

Attackers compromised software updates for SolarWinds' Orion network monitoring tool, reaching roughly 18,000 customers, including US government agencies. The intruders operated inside victim networks for months before being detected.

Then

Agencies and companies rushed to disconnect Orion and audit their networks.

Now

The breach pushed software supply chain security onto the policy agenda and led to new federal cybersecurity rules.

Why this matters now

It established the template for a vendor compromise that reaches customers who never interacted with the attacker directly.

January-April 2021

Codecov supply chain attack (2021)

An attacker modified Codecov's Bash Uploader script, which customers ran in their software build pipelines. The altered script sent environment variables and credentials to an outside server.

Then

Codecov customers had to rotate credentials and audit their build systems.

Now

The incident became a standard example of how developer tooling can leak secrets across many organizations at once.

Why this matters now

It shows how a vendor's internal tooling can expose customer secrets without the customer sending them deliberately.

May 2023

MOVEit data theft campaign (2023)

A criminal group exploited a flaw in Progress Software's MOVEit Transfer file-sharing product and stole data from thousands of organizations, including payroll and government records.

Then

Victims spent months notifying employees and regulators.

Now

The campaign pushed vendors toward faster patching and more disclosure of stored customer data.

Why this matters now

It illustrates the risk of data sitting at rest on a vendor's systems, which is where Notion's transcripts were found.

Sources

(7)
+1
Notion BleepingComputer TechCrunch VentureBeat The Hacker News Fireworks AI Bloomberg Law