Menu
Breach Value Calculator

Fireworks AI Breach: Notion AI Chat Transcripts Exposed

Fireworks AI says attackers reached it through a cloud provider, and Notion says some Notion AI chat transcripts were in the data. What to do now.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Identified: 24 October 2026Published 3 min read

Fireworks AI, a platform that runs and fine-tunes AI models for other companies, says attackers reached its systems through a breached cloud provider, and Notion says some Notion AI chat transcripts were in the data taken. If Notion has emailed you, treat that data as exposed and rotate any password or API key anyone pasted into Notion AI; Fireworks customers should rotate every secret stored on the platform.

Sources checked 12 November 2026. Both companies say their investigations are still open.

What happened in the Fireworks AI breach

Fireworks says a "third-party cloud provider that hosted Fireworks R&D machines" had a security incident on 23 October 2026. On 24 October an unauthorised party used it to reach Fireworks development machines and run a workload; Fireworks says it detected this the same day. It does not name the provider (Fireworks, update of 9 November).

This was the second incident in a month. On 6 October Fireworks identified "unauthorized use of internal Fireworks credentials", which exposed secrets such as API keys in a limited number of customer accounts (Fireworks, 9 October).

The 9 November update widened the scope: resource metadata, billing details (addresses, invoices, payment history, credit usage), and for some customers datasets and incomplete model weights. Payment card numbers were not stored, Fireworks says. It has told law enforcement, works with Palo Alto Networks Unit 42, and links the activity to a financially motivated criminal group that resells unauthorised access to AI models.

Notion says Fireworks told it on 2 November that "a small set of data" had been accessed, and confirmed the final dataset on 8 November. It included Notion AI chat transcripts used for Notion's Insights feature. Notion says that for most affected workspaces the chats were "unattributable" and "did not contain tool call results" (Notion advisory, 10 November, updated 11 November).

Who is affected

  • Notion: fewer than 1% of workspaces, Notion says. It began contacting them on 9 November. "If you haven't heard from us, we haven't identified your workspace as affected, and no action is needed right now."
  • Fireworks: customers it is notifying directly. It has not published a count, and it says it detected no impact on Inference, the Training SDK or Nexus.

Notion disconnected from Fireworks on 3 November, deleted its data there, disabled Insights, stopped serving open-weight models through Fireworks, and on 11 November revoked Notion API keys found in affected messages.

What to do now

  1. Notion customers who were emailed: review the affected data inside your workspace using Notion's instructions, and treat it as exposed.
  2. If you were emailed, rotate anything pasted into Notion AI: passwords, API keys, tokens. Notion revoked its own API keys; third-party keys are yours to rotate.
  3. Fireworks customers: follow your notice. Fireworks says removing a stored secret does not cancel it, so rotate it with whoever issued it, then check for API keys, users, jobs or datasets you don't recognise.
  4. Everyone using AI vendors: ask where your prompts and chat logs are stored, for what purpose, by which sub-processors, and how fast you will be told. Fireworks says its inference does not store prompts by default; these transcripts sat in a dataset kept for a separate feature. My reading: a no-retention promise covers one data path, not every copy.

Related: OpenAI's Mixpanel vendor incident, the 302.ai exposure, Chat & Ask AI, AI model gateways and the AI at work privacy checklist.

Sources

Read on 12 November 2026.

Spotted a mistake? Report a correction.