🔍 Read the full analysis: Notion AI Chat Transcripts Reportedly Exposed In Fireworks Breach on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Notion says data accessed in the Fireworks AI breach included stored Notion AI chat transcripts used for its Insights feature. The company says fewer than 1% of workspaces were affected, and that it revoked exposed Notion API keys found in affected messages on November 11. The affected Fireworks system, retention period and full number of people affected have not been disclosed.
Notion says a dataset accessed in the Fireworks AI breach included stored chat transcripts from Notion AI’s Insights feature, and that data was retained by Fireworks despite a contractual commitment to zero data retention. The company says fewer than 1% of Notion workspaces were affected and reports that it revoked exposed Notion API keys found in affected user messages on November 11.
In its updated security advisory and Help Center notice, Notion said Fireworks provided it with a dataset on November 8 that included Notion AI chat transcripts used for Insights, a feature that gives workspace administrators information about team AI use. Notion said that for most affected workspaces, the transcripts were “unattributable”: they were not labeled with the author or workspace and did not include tool-call results. That description does not mean the chats contained no sensitive information. Notion defines a transcript as input or output written to the chat, and advises affected customers to examine the data because it could include sensitive details.
Notion said the incident affected fewer than 1% of workspaces. It also said that on November 11 it revoked exposed Notion API keys found in affected user messages. The company advises affected users to review the exposed material under its Security incident review guidance and rotate passwords, API keys or other credentials they entered into Notion AI during the incident. Notion says users or workspace owners who have not been contacted have not been identified as affected.
The company said AI Meeting Notes were not affected, except where audio, transcripts or summaries had been entered as input in a Notion AI chat transcript. It said no other Notion features were affected. The exposed data came from the Insights use of Fireworks, according to Notion, rather than the separate use of Fireworks to serve open-weight models within the product.
Notion AI transcripts exposed in Fireworks breach
Notion says data accessed in the breach included stored chat transcripts used for Insights. The disclosure raises questions about sensitive chat content and vendor data retention.
What the dataset contained
Notion says the exposed records came from Insights, which gives administrators information about team AI use.
Stored transcripts
Records included text entered into or produced by Notion AI chats.
Often unattributable
Most affected workspaces’ transcripts lacked author and workspace labels and tool-call results.
Review the content
Unlabeled records could still contain sensitive details or credentials typed into chats.
How the exposure unfolded
What customers should do
Notion advises affected customers to assess the exposed material and act on credentials that may appear in chats.
- Review exposed records using Notion’s Security incident review guidance.
- Rotate passwords, API keys or other credentials entered into Notion AI during the incident.
- Follow direct notices from Notion; users or workspace owners not contacted have not been identified as affected.
What remains unclear
- Fewer than 1% of workspaces were affected.
- Notion says the data came from Insights use of Fireworks.
- AI Meeting Notes were not affected, except material entered into an AI chat transcript.
- The Fireworks system involved or how long data was stored.
- The exact number of affected people and workspaces.
- Whether specific messages contained credentials or how attackers used the data.
What Exposed Chat Data Could Contain
The incident matters because chat transcripts can include information people type into an AI assistant, including customer names, contract details or credentials. Notion says the records in most affected workspaces lacked author and workspace labels, but that does not establish that the text itself was harmless or impossible to identify. The company recommends that affected customers assess the specific data rather than rely on the lack of labels.
The disclosure also highlights a distinction between zero retention for live model requests and storage needed to operate product features. Notion says its zero-data-retention commitments for model vendors apply to API requests used to generate responses, while stored chat history and Insights data are retained to provide those features. In this case, Notion says Fireworks had separately made a contractual zero-retention commitment for Notion’s use of its platform, but data was retained from the endpoints involved.
For customers, that raises practical questions about what was entered into chats and whether any exposed credentials remain usable. For organizations that depend on external AI processors, it also makes vendor data-handling commitments and the systems covered by them directly relevant to incident response.
Products Worth Considering
Dell UltraSharp U2724DE 27-Inch WQHD IPS Black Monitor
LG UltraGear 32-Inch QHD 180Hz Curved Gaming Monitor
Canon IVY 2 Mini Photo Printer Bundle, Blush Pink
As an affiliate, we earn on qualifying purchases.
How Notion Used Fireworks
Notion said it used Fireworks for two purposes: classification jobs for Insights and as an inference provider for open-weight models in Notion’s product. It said the dataset involved in this exposure came from the Insights work, which used stored requests and responses from Notion AI activity. The company’s notice distinguishes this stored feature data from live requests sent to vendors to generate AI responses.
Notion’s published timeline says Fireworks notified it on November 2 that a small set of data had been accessed. Notion initially understood the data to be synthetic testing material. On November 3, it says it disconnected its systems from Fireworks, deleted data in the Fireworks system and stopped communication with the provider. Notion also says it halted training runs. The later investigation produced the November 8 dataset and the expanded disclosures on November 10 and 11.
Fireworks’ own bulletin, as described in the source material, was last updated November 9. Fireworks said it had not detected an impact to Inference, Training SDK and Nexus, which it described as zero-retention by default, while also listing datasets among information accessed for certain customers. The published statements do not specify which Fireworks system retained Notion’s data or explain how that relates to the company’s general description of its services.
“Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.”
— Notion, in its updated Help Center notice
What the Notices Do Not Specify
The notices do not identify which Fireworks system retained the data, how long it was stored, or the exact number of people and workspaces involved. Notion’s estimate is given as a share of workspaces, not as a total count. The published material also does not say whether the dataset included credentials or other sensitive details in any particular user’s messages.
It is also unclear how the retained Notion data fits with Fireworks’ statement that its Inference, Training SDK and Nexus services are zero-retention by default. Neither company’s account, as provided here, explains which endpoint or storage system was involved. There is no information establishing whether other Fireworks customers experienced the same retention issue. The available notices do not confirm how the attackers used or distributed the data.
Customer Reviews and Vendor Audits
Notion says affected customers should review the exposed data using its Security incident review guidance and rotate any passwords, API keys or other credentials that may have been included in chats. Workspace owners should follow direct notices from Notion and assess relevant records rather than assume that an unattributable transcript contains no sensitive information.
Notion says it is auditing critical vendors, including inference providers and data processors, to check their data-minimization practices and zero-retention policies. Further clarity will depend on additional information from Notion or Fireworks about the affected endpoints, the retention period, and the scope of data access. The Fireworks bulletin cited in the source material had not been updated beyond November 9, while Notion’s advisory changed on November 10 and 11.
Key Questions
What Notion data does the company say was exposed?
Notion says the dataset accessed in the Fireworks breach included Notion AI chat transcripts used for its Insights feature. It says most affected workspaces’ transcripts were not labeled with the author or workspace and did not contain tool-call results.
How many Notion workspaces were affected?
Notion says fewer than 1% of workspaces were affected. The supplied notice does not give an exact workspace or user count.
Were Notion AI Meeting Notes affected?
Notion says AI Meeting Notes were not affected unless audio, transcripts or summaries were used as input in a Notion AI chat transcript. It says no other Notion features were affected.
What should affected users do?
Notion advises affected users to review the data under its Security incident review guidance and rotate any passwords, API keys or other credentials they entered into Notion AI during the incident. It says exposed Notion API keys found in affected user messages were revoked on November 11.
What remains unknown about the Fireworks breach?
The published notices do not identify the Fireworks system that retained Notion’s data, say how long it was retained, provide an exact count of affected people, or establish whether other Fireworks customers faced the same issue.
Source: ThorstenMeyerAI.com
