Notion has confirmed that a security incident involving vendor Fireworks AI resulted in the exposure of a small subset of Notion AI chat transcripts. The breach, first flagged by a Hacker News user who received a direct notification, affects less than 1% of Notion workspaces. The exposed data consists of unattributable chat sessions used for the Insights feature, meaning the logs lacked metadata linking them to specific users, workspaces, or companies.

The Fireworks AI Connection

Fireworks AI serves as a critical infrastructure provider for Notion, handling classification jobs for the Insights feature and serving open-weight models for general inference. Following the initial alert from Fireworks regarding potential unauthorized access, Notion immediately severed all connections to the vendor's systems. By November 6, Fireworks notified Notion that malicious actors may have accessed customer data, leading to a deeper internal investigation that confirmed the specific nature of the leak on November 8.

Data Scope and Mitigation Steps

The leaked transcripts did not contain tool call results or identifiable metadata, limiting the exposure to the raw text of the conversations themselves. Notion has disabled the Insights feature and ceased using Fireworks for open-weight model serving while the investigation continues. Users are advised to review their workspace data, which can be retrieved securely within Notion, and to treat the exposed chats as public. If sensitive information such as passwords, API keys, or credentials were pasted into these AI chats during the affected period, immediate rotation of those secrets is recommended.

Key Takeaways

  • Less than 1% of Notion workspaces were impacted by the Fireworks AI vendor breach.
  • Exposed data included only unattributable chat transcripts without user or workspace identifiers.
  • Notion has disabled the Insights feature and stopped using Fireworks for open-weight models.
  • Users must rotate any API keys or passwords pasted into Notion AI chats during the incident window.

The Bottom Line

While the lack of attribution mitigates the risk of targeted phishing, the exposure of raw chat content remains a significant privacy concern for developers and teams who rely on AI assistants for sensitive work. This incident underscores the critical importance of treating vendor-managed AI infrastructure with the same rigor as direct database security, including mandatory credential rotation and strict data minimization practices.