al-ice.ai

Your AI Chats Lived at the Vendor Too: Notion AI Transcripts Exposed Through the Fireworks Breach

Agent & Supply Chain Security by al-ice.ai Editorial

On 10 November 2026, Notion published a security advisory confirming what the Fireworks AI incident series had been building toward for a month: a downstream customer’s user data is now confirmed exposed. Notion AI chat transcripts from fewer than 1% of Notion workspaces were part of the dataset attackers reached inside Fireworks AI, the inference provider Notion used for its Insights classification jobs and for serving open-weight models. Notion states plainly that this was not a breach of its own systems — and then spends the rest of the advisory explaining why that distinction does not contain the damage.

The timeline: eleven days from first notice to containment

The advisory’s dated timeline is unusually precise, and worth reading as a vendor-incident-response case study. On the evening of 2 November, Fireworks told Notion a small dataset had been accessed; Notion’s investigation initially concluded it held only synthetic testing data with no customer involvement. By the morning of 3 November — out of caution, before any customer data was confirmed — Notion disconnected its systems from Fireworks, deleted all of its data in Fireworks systems, and cut all communication between the two environments. On 6 November, Fireworks revised its notice: malicious actors may have accessed potential customer data. Notion opened a second investigation, received the final impacted dataset on 8 November, and contacted impacted customers on 9 November. The advisory went live on 10 November (revised the same day for style, with no changes to reported facts), followed by an 11 November update: Notion revoked exposed Notion API keys found in affected user messages during its investigation.

That last line deserves emphasis. API keys were sitting inside the exposed chat transcripts, and they were still valid until Notion revoked them on day eleven. Whatever was pasted into Notion AI during the exposure window — passwords, tokens, credentials — has to be treated as compromised.

What was exposed, and the limits of unattributable

The exposed material was Notion AI chat transcripts used for the Insights feature, and Notion leans on one qualifier: for the vast majority of impacted workspaces the chats were unattributable — not labeled with who wrote them or which workspace they came from, with no tool call results attached. Beyond the transcript text itself, it states, there is no information tying a chat back to a workspace, user, or company. No other Notion features were affected.

Unattributable is meaningful, but it is not the same as harmless. Transcript text routinely contains the very things Notion now tells affected customers to rotate. Attribution is also a property of the data, not just the labels: a chat discussing a named project, a customer, or an internal system re-identifies itself. Notion’s own guidance concedes the point — affected customers are told to treat the data as if it were exposed, retrieve and review the impacted material inside their workspace via emailed instructions, and rotate anything sensitive pasted into Notion AI during the incident timeframe.

The third downstream rib of one incident

This is the third briefing this site has published on the Fireworks incident chain, and each one widened the blast radius. The October evaluation-jobs breach took customer API keys and tokens; the second breach via a third-party R&D cloud reached billing data, datasets, and incomplete model weights for a limited set of accounts, with Notion and Cursor named as notified customers. Now the downstream customer impact is concrete and user-facing: one vendor’s compromise became another vendor’s user-data exposure, exactly the supply-chain shape this month’s GitBook agent-infrastructure breach illustrated from a different angle. Press coverage carried as reported adds consistent color: BleepingComputer confirmed the transcript exposure on 11 November, and VentureBeat reported the data sat in Fireworks storage outside zero-data-retention terms, with Notion cutting traffic by 3 November and pausing training runs. Notion has disabled the Insights feature pending investigation and is no longer serving open-weight models through Fireworks.

What to actually do

  1. If you run Notion AI and have not heard from Notion, no action is needed right now — but treat that as a status, not a verdict, while the investigation continues.
  2. If you were notified, retrieve and review the impacted data inside your workspace using the emailed instructions, assume it is exposed, and rotate every secret, password, and API key that appears in — or plausibly adjacent to — the exposed transcripts. Remember Notion already revoked exposed Notion API keys on 11 November; yours in other systems are your job.
  3. Inventory which of your vendors’ vendors can see your users’ prompts. Classification jobs, analytics pipelines, and inference failover are the places AI transcripts quietly replicate outside zero-retention boundaries. Ask each AI provider where prompts are stored, for how long, and under whose retention policy — then verify the answers contractually.
  4. Separate inference serving from analytics over prompts: the Insights classification pipeline is what put transcripts at rest inside a third party. Analytics over user prompts should inherit the strictest retention in the chain, not the loosest.

Our verification was read-only. We read Notion’s Fireworks AI incident advisory first-hand in full (originally published 10 November 2026, status Investigating; 2 November initial Fireworks notice of synthetic-data-only access; 3 November disconnect, data deletion, and communications cutoff; 6 November revised notice of potential customer data; 8 November final dataset; 9 November customer outreach; 10 November publication; 11 November API-key revocation; under 1% of workspaces; Insights transcripts, vast majority unattributable, no tool call results; Insights disabled; open-weight serving via Fireworks ended; per-customer retrieval and rotation guidance). BleepingComputer (11 November) and VentureBeat (11 November) were carried as reported for confirmation and timing. Prior Fireworks coverage on this site is linked above. We tested nothing, touched no vendor infrastructure, and contacted no vendor. Brave Search was used for discovery only.

Sources: