Notion has confirmed a security incident involving third-party vendor Fireworks AI, resulting in the exposure of Notion AI chat transcripts for a small subset of users. The breach, which affected less than 1% of Notion workspaces, was disclosed in a security advisory updated on November 10, 2026. While Notion states the incident was not a breach of their own systems, the reliance on external inference providers has once again highlighted the supply chain risks inherent in modern AI infrastructure stacks.

Timeline of the Incident

The trouble began on the evening of November 2, when Fireworks notified Notion that a small set of data had been accessed by malicious actors. Initial investigations suggested the data was limited to Notion AI synthetic testing data. However, the situation escalated on November 6, when Fireworks informed Notion that potential customer data might have been involved. By November 8, Fireworks confirmed the final impacted dataset, prompting Notion to reach out to affected customers on November 9. In response, Notion disconnected its systems from Fireworks, deleted all data within the Fireworks system, and ceased all communication with the vendor by the morning of November 3.

Data Exposure and Mitigation

Analysis of the exposed data revealed it included Notion AI chat transcripts used for the Insights feature. Notion emphasizes that for the vast majority of impacted workspaces, these transcripts were 'unattributable,' meaning they lacked labels identifying the author or the originating workspace. Furthermore, the transcripts did not contain tool call results, limiting the contextual information available to attackers. No other Notion features were affected. The Insights feature has been temporarily disabled, and Notion has stopped serving open-weight models through Fireworks pending further investigation.

Recommendations for Developers

Notion has advised affected customers to treat the exposed data as compromised. If users pasted sensitive information, such as passwords, API keys, or other credentials, into Notion AI during the incident timeframe, they are strongly encouraged to rotate those secrets immediately. Affected users can retrieve and review the impacted data securely within their workspace, with specific instructions sent via email. Notion asserts that keeping user data safe is fundamental to its mission and promises to raise the standard for data protection in future vendor relationships.

Key Takeaways

  • Malicious actors accessed Notion AI chat transcripts via Fireworks AI, affecting <1% of workspaces.
  • Notion disconnected from Fireworks and deleted all data within the vendor's system by November 3.
  • Exposed transcripts were largely 'unattributable,' lacking user or workspace labels.
  • The Notion Insights feature is disabled, and open-weight model serving via Fireworks has stopped.
  • Users are advised to rotate any API keys or credentials pasted into Notion AI during the exposure window.

The Bottom Line

This incident proves that outsourcing AI inference to third-party vendors introduces unavoidable supply chain risks that internal security controls cannot fully mitigate. Developers must audit their AI infrastructure dependencies and treat vendor data stores as potential breach vectors, not just utility endpoints.