Overview
Notion has disclosed that a security breach at its AI infrastructure provider, Fireworks AI, exposed Notion AI chat transcripts in a small number of workspaces. Notion says fewer than 1% of its users were affected. Fireworks hosts some of the open-weight models that power Notion AI.
This follows Fireworks' own disclosure of a wider breach; see our earlier coverage: Fireworks AI breach affecting customer data.
What Was Exposed
- Notion AI chat transcripts from the "Insights" dataset, which gives workspace admins visibility into how teams use AI.
- Notion says the transcripts were mostly unattributable: not labeled with the author or workspace, and without tool call results.
- Transcripts may still contain anything users typed into a chat, such as pasted credentials or sensitive business text.
Timeline
| Date | Event |
|---|---|
| Early Oct | A separate Fireworks breach exposed environment variables with API keys and tokens for a limited number of accounts |
| Oct 23 | An attacker accessed Fireworks' development environment through a third-party cloud provider |
| Nov 2 | Fireworks alerted Notion to an exposed dataset that Notion believed held only synthetic test data |
| By Nov 3 | Notion cut traffic to Fireworks, deleted its data from the vendor's systems, and halted training runs |
| Nov 8 | Fireworks confirmed customer data was accessed; Notion then found the transcripts in the dataset |
Fireworks said the attacker compromised resource metadata, billing information, model weights, and datasets for some customers. Notion says Fireworks had contractually committed to zero data retention for Notion data, yet the transcripts were present in a dataset. Notion has disabled the Insights dataset and published an advisory and FAQ.
What to Do
- Workspace owners: open Security incident review in the Notion desktop or web app to see whether your workspace is affected. You can share a link that lets members download their own transcripts.
- Rotate credentials (passwords, API keys, tokens) that anyone entered into affected AI chats.
- If neither you nor your workspace owner received a notice, Notion says no action is needed for now.
Takeaways
- AI vendors are part of your supply chain. Data flowing to inference and training providers needs the same vendor risk review as any processor.
- Zero-retention promises need verification. Ask for evidence and audit rights, not only contract language.
- Treat AI chat as sensitive input. Establish policy on what may be pasted into AI assistants.