🔍 Read the full analysis: What Users Should Know About Notion AI And The Fireworks Breach on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Notion says a dataset accessed in the Fireworks AI breach included Notion AI chat transcripts used for its Insights feature. The company says fewer than 1% of workspaces were affected and that it revoked exposed Notion API keys found in affected messages on November 11, 2026.
Notion says a dataset accessed by attackers in the Fireworks AI breach included chat transcripts from its AI-powered Insights feature, and that on November 11 it revoked exposed Notion API keys found in affected user messages. Notion estimates that fewer than 1% of workspaces were affected and advises those notified to treat the data as exposed.
Notion’s updated security advisory says Fireworks supplied it with a dataset on November 8 that included Notion AI chat transcripts used for Insights, a feature that helps workspace administrators understand how teams use AI. Notion says that for most affected workspaces, the transcripts were not attributable: they were not labeled with the user or workspace, and did not contain tool-call results.
That does not mean the transcripts were necessarily free of sensitive information. Notion defines a transcript as any input to or output from the model that was written to the chat. It advises affected customers to review the data because prompts or responses may have included customer details, contract information, passwords or other sensitive content. The company says AI Meeting Notes were not affected unless their content was used as input in a Notion AI chat transcript; it says no other Notion features were affected.
Notion says it disconnected its systems from Fireworks on November 3, deleted its data from Fireworks’ system and stopped communications between the companies’ systems. It also halted training runs, according to the advisory timeline. On November 11, it revoked Notion API keys found in affected user messages. The company recommends that notified users review the incident under its Security incident review guidance and rotate credentials pasted into Notion AI during the incident.
Notion AI and the Fireworks breach What users should know
Notion says a dataset accessed in the Fireworks breach included chat transcripts used for Insights. Notified workspaces should review the content and treat it as exposed.
What the dataset contained
Notion says the transcripts came from Insights analysis of stored Notion AI requests and responses.
Prompts and responses
Chat inputs or outputs may have included customer details, contract information, passwords or other sensitive content.
Often unlabeled
Notion says most affected transcripts were not labeled with a user or workspace and did not include tool-call results.
What users should do
Notion advises notified customers to review the actual data, not assume unlabeled transcripts are harmless.
Follow Notion’s Security incident review guidance and examine relevant chat inputs and outputs.
Change passwords, API keys and other credentials pasted into Notion AI during the incident.
What was affected
Notion identifies Insights transcripts as the source of the exposed data.
| Content or feature | Notion’s account |
|---|---|
| Insights chat transcripts | Included in the accessed dataset |
| AI Meeting Notes | Not affected unless used as chat input |
| Other Notion features | Not affected |
What remains unclear
The public notices leave important questions open for organizations assessing vendor risk.
- Which Fireworks system retained the data, and for how long?
- Why was data retained despite a contractual zero-data-retention commitment?
- Whether other Fireworks customers’ data was affected.
- Whether attackers viewed or used any particular transcript.
Why Exposed AI Chats Matter
The incident is a reminder that an AI interaction may leave records beyond the live request and response. Even when a feature sends information to a provider for analysis, stored prompts and outputs can contain business-sensitive material entered by employees. Notion’s notice means affected organizations should review actual chat content, rather than assume that transcripts were harmless because they lacked user and workspace labels.
The case also puts attention on what zero data retention (ZDR) promises cover. Notion says Fireworks had a contractual commitment to zero data retention for Notion’s use of its platform, but that data from the endpoints Notion used was retained. The incident does not establish why the data was retained or whether other customers’ information was involved. It does show that organizations need to understand the scope of retention terms and how vendors handle data used for features such as analytics.
Products Worth Considering
Kindle Paperwhite Signature Edition 32GB E-Reader, 7-Inch Display, Seaglass Green
Amazon Kindle Paperwhite (12th Generation, 2024), 16GB, 7-Inch Display, Raspberry
Amazon Kindle Scribe Colorsoft 64GB with 11-Inch Color Display and Premium Pen, Graphite
As an affiliate, we earn on qualifying purchases.
How Insights Used Fireworks
Notion says it used Fireworks for two purposes: classification jobs for Insights, and as a general inference provider for open-weight models in its product. The exposed data described in Notion’s notice came from the Insights work. The company says it sent Fireworks stored requests and responses from Notion AI use for analysis, rather than only live requests needed to generate answers.
Notion’s FAQ distinguishes live model requests from stored information needed to provide features. It says its ZDR commitments for model vendors apply to API requests used to generate Notion AI responses, while uses such as chat history and Insights can require data retention. Notion says Fireworks had separately made a contractual ZDR commitment, but that its investigation found data retained from the endpoints it used. Fireworks’ own bulletin, last updated November 9, said it had not detected an impact to Inference, Training SDK and Nexus, which it describes as ZDR by default, and listed datasets among data accessed for certain customers.
Notion’s timeline says Fireworks first notified it on November 2 that a small set of data had been accessed by malicious actors; Notion initially understood that data to be synthetic testing data. Notion later updated its advisory on November 10 and 11. Its account differs in scope from the earlier understanding, while Fireworks’ published bulletin had not changed by November 12, according to the supplied source material.
“Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.”
— Notion
What the Notices Do Not Explain
The public notices do not identify which Fireworks system retained Notion’s data, how long it was stored, or why the retention occurred despite the contractual commitment. They also do not give a specific number of affected users or workspaces beyond Notion’s estimate that fewer than 1% of workspaces were affected.
It remains unclear whether the same issue affected data belonging to other Fireworks customers. Fireworks’ bulletin says certain customer datasets were accessed and that it had not detected an impact to specified ZDR-by-default services, but the published information does not reconcile that statement with Notion’s account. The material also does not establish whether attackers viewed or used each transcript, or what information any particular affected transcript contained.
Reviews and Vendor Audits Ahead
Notion says it is auditing critical vendors, including inference providers and data processors, to check their data-minimization practices and compliance with zero-retention policies. Affected workspace owners should follow Notion’s incident-review guidance, examine relevant chat inputs and outputs, and rotate any passwords, API keys or other credentials that may have been pasted into chats.
Further clarity depends on updates from Notion and Fireworks, including details about the system involved, the retention period and whether other customers’ data was affected. Until those details are published, organizations should treat Notion’s estimate and Fireworks’ service-level statement as separate claims, not as a complete account of the breach’s scope.
Key Questions
Were Notion AI chat transcripts accessed in the Fireworks breach?
Notion says yes: the dataset it received from Fireworks on November 8 included transcripts used for the Insights feature. The company has not said that every affected transcript was viewed by attackers.
How many Notion workspaces were affected?
Notion estimates that fewer than 1% of workspaces were affected. It has not published a precise count in the source material.
What should a notified workspace do?
Notion advises affected customers to treat the data as exposed, review it under its Security incident review guidance, and rotate credentials—including passwords and API keys—pasted into Notion AI during the incident.
Were AI Meeting Notes affected?
Notion says AI Meeting Notes, including audio, transcripts and summaries, were not affected unless their content was used as input in a Notion AI chat transcript.
Does Notion know why Fireworks retained the data?
The published information does not explain which Fireworks system retained the data, how long it was kept or why. Notion says its investigation found retention despite Fireworks’ contractual zero-data-retention commitment.
Source: ThorstenMeyerAI.com
