Notion has confirmed that data stolen in the Fireworks AI breach included transcripts of its users’ AI chats, making it the first major customer to say its users’ data was caught up in the incident. The company said fewer than 1% of its workspaces were affected, and that for the vast majority of those, the chats could not be traced back to any person or workspace. Notion has disabled the Insights feature that used Fireworks, stopped serving open-weight models through the vendor, and told affected customers to treat the exposed data as public and rotate any credentials they pasted into its AI chats.
What Notion found
The timeline Notion published starts on the evening of 2 November, when Fireworks told it that a small set of data had been accessed by malicious actors. On inspection, that first dataset held only Notion AI synthetic testing data, with no customer data involved.
Notion moved fast on that first warning. By the morning of 3 November it had disconnected its systems from Fireworks, deleted all of its data held in the vendor’s systems, and stopped all communication between the two. The company also told affected customers at the time that no customer data had been involved.
The picture changed on 6 November, when Fireworks warned that malicious actors may have reached potential customer data. Notion opened a second internal investigation, and on 8 November Fireworks confirmed the new dataset. Analysis showed it included Notion AI chat transcripts used for the Insights feature, which helps customers understand their own AI usage.
What was in the data
Notion stressed that the transcripts were, for the vast majority of impacted workspaces, unattributable. The chats carried no labels saying who wrote them or which workspace they came from, and they contained no tool call results. Beyond what is written in a chat itself, Notion said, there is nothing tying it back to a workspace, a user, or a company.
That distinction matters, but it is not a clean bill of health. The chats are real conversations people had with Notion AI, and anyone holding them can read what was asked and answered. Notion told affected customers they can retrieve and review the impacted data securely inside their workspace, and to treat it as if it were exposed.
The advice goes further for anyone who pasted sensitive material into the AI chats during the incident. Notion said those customers should rotate any passwords, API keys, or other credentials involved. No other Notion features were affected, the company said, and its investigation is continuing.
Our Read
This is the breach story Fireworks’ own bulletin could not tell. Fireworks said it had detected no impact on its inference service, which retains no data by default; Notion’s advisory shows that, for at least one major customer, AI chat transcripts did leave through the vendor. The gap between those two statements is now the central question of the incident.
The unattributable detail is genuinely reassuring for most affected users, and Notion is right to lead with it. But ‘unattributable’ is not harmless: the chats still contain whatever people typed, and the advice to rotate credentials admits some of it is sensitive. Companies routing AI features through outside vendors should note where their users’ words actually live.
Notion’s response itself sets a useful standard: disclose the vendor, publish the timeline, say exactly what was in the data, and cut the vendor off. Other Fireworks customers — Cursor was also named — have not yet said whether their users’ data was involved. The incident will be judged, in the end, by how many of them follow Notion’s lead.
Why It Matters
Vendor breaches are becoming the way AI data leaks. The model provider is rarely the one attacked; the infrastructure in between is. When Fireworks was breached, the data at risk belonged to its customers, and Notion’s users learned about it from Notion, not Fireworks. That chain — vendor, customer, user — is the shape of an AI security incident.
The regulatory direction is clear, too. Australia has just created a dedicated AI safety regulator with mandatory breach reporting after its own AI agent incident, and lawmakers elsewhere are watching the same pattern. Vendor incidents that expose user data will increasingly be treated as the vendor’s problem first — and the customer’s disclosure duty second.
Background
Fireworks AI is a major inference provider used by tens of thousands of customers. Its October breach widened in a 9 November update, when a third-party cloud provider hosting its research machines was compromised and the intrusion reached its development machines. Billing data, secrets, datasets and model weights were exposed.
Source: Notion’s security advisory
0 Comments