Notion says some Notion AI chat transcripts may have been exposed in a breach at Fireworks AI, one of its AI vendors, and that fewer than 1% of Notion workspaces may have been affected. If anyone in your workspace pasted a password or API key into Notion AI, that secret may now be in someone else's hands. It also got there through a vendor you never picked.
The short version: if neither you nor your workspace owner has heard from Notion, Notion says you are not affected. If you have, open the incident review and rotate any credentials that went into a chat.
What Notion says was exposed
According to Notion's help page, the exposed data is "unattributable" Notion AI chat sessions. That means the chats carried no author or workspace label. Notion says the transcripts did not include tool call results, such as Notion page content or outside data pulled in by Notion AI, and that no other workspace data is affected.
The catch is the words in the chats themselves. Notion says nothing beyond the transcript ties a chat to a person or company, but a transcript can name people, projects or clients. Notion's own advice is to treat the data as if it were exposed.
Notion used Fireworks for three things, per the same page: classification jobs for its Insights feature, which helps customers understand their AI usage; serving open-weight models inside Notion; and experiments training task-specific models with data volunteered by Learning and Early Access Program (LEAP) customers. Insights is disabled while Notion investigates, and Notion says it no longer serves open-weight models through Fireworks.
Notion does not say how many chats or users are involved, or what time window the exposed chats cover.
How to check your workspace
Notion has contacted the owners of affected workspaces. If you are an owner:
- Open Notion in the desktop app or a web browser, on the latest version. The data is not available on mobile.
- In the sidebar, click
?, thenSecurity incident review. - On Enterprise, download the CSV of affected data and the annotated CSV. These are only available if the workspace has managed members.
- On any other plan, share the link from the review page with members. Each member who opens it gets a CSV of only their own affected data.
The Enterprise annotated CSV adds metadata, such as the user tied to each transcript. Notion says those annotations were not part of what was exposed; they are the fields marked __metadata or __analysis.
Rotate anything pasted into Notion AI
Notion says that if anyone pasted passwords, API keys or other credentials into Notion AI during this period, rotate them right away. Go through the CSVs, search for anything that looks like a key, token or password, and revoke it at the service that issued it. Then stop pasting secrets into AI chats, in Notion or anywhere else.
What Fireworks says happened
Fireworks' updated security bulletin, last updated November 9, 2026 and marked "Active monitoring", says a third-party cloud provider hosting its R&D machines had a security incident on October 23. On October 24, the attacker used that to reach Fireworks development machines and ran an unauthorized workload that caused additional customer data impact. Fireworks says it detected this the same day, and as of October 25 had detected no further successful unauthorized access to its customer platform.
Fireworks says the affected data includes resource metadata, billing information and, for certain customers, a subset of datasets and incomplete model weights. It says it does not store payment card numbers. It links the attack to a financially motivated group doing "LLMjacking": selling tokens from unauthorized access to LLMs to illicit routing gateways. That attribution is Fireworks' claim. Fireworks says it notified law enforcement and brought in Palo Alto Networks Unit 42.
Notion's timeline: by November 3 it had disconnected from Fireworks, deleted its data there and halted training runs. On November 6, Fireworks told Notion attackers may have accessed customer data, and on November 8 confirmed a new dataset that Notion found included the Insights chat transcripts.
Where the two accounts don't line up
Fireworks says its Inference service, zero data retention by default, was not affected. Notion says chat transcripts from Insights classification jobs were exposed. Fireworks does list datasets as affected for some customers, but neither company explains how Notion's transcripts ended up in Fireworks storage. Fireworks' November 9 bulletin also does not mention Notion. Both accounts are vendor statements, and no independent reporting was available to settle the gap.
What to watch
Fireworks says its investigation is ongoing and "may reveal additional information". Watch its bulletin for the next update, and for whether Notion revises its fewer-than-1% figure or turns Insights back on.
