Fireworks AI Breach Exposed Notion AI Chat Transcripts

What people typed into Notion AI, and what it wrote back, turned up in a dataset attackers accessed at Fireworks AI, an inference company Notion used to run AI jobs. Notion's security advisory, first published November 9, 2026, puts the impact at fewer than 1% of Notion workspaces. The harder detail sits in Notion's FAQ: Fireworks had signed up to zero data retention, and Notion says the data was retained anyway.

Key Takeaways

• Fireworks AI detected attackers misusing internal credentials on October 6, 2026, and a second intrusion through a third party cloud provider reached its development machines on October 24.
• Notion says Fireworks confirmed on November 8 that an accessed dataset included Notion AI chat transcripts used for the Insights feature, affecting fewer than 1% of Notion workspaces.
• Notion's FAQ says Fireworks gave a contractual commitment to zero data retention, yet "data was retained from the Fireworks endpoints that we used."
• Fireworks is named on Notion's public subprocessor list as compute infrastructure for serving large language models, one of nine entries there that host or serve such models.
• Notion tells affected workspaces to treat the transcripts as exposed and to rotate any passwords, API keys or other credentials pasted into Notion AI.

What Happened at Fireworks AI?

Fireworks AI was breached twice in October 2026, first with misused internal credentials and then through a cloud provider that hosted its research machines. The Record describes it as a San Mateo company founded in 2022 with more than 10,000 customers.

The first Fireworks bulletin says that "On October 6, Fireworks identified a security incident involving unauthorized use of internal Fireworks credentials." The intruder read environment variables used in evaluation jobs in "a limited number of customer accounts," capturing API keys and tokens stored as secrets. Fireworks added: "Fireworks does not store prompts or outputs by default, as our platform is ZDR."

The November 9 update widened the picture. "A third-party cloud provider that hosted Fireworks R&D machines experienced a security incident on October 23," it says, and on October 24 the intruder ran "an unauthorized workload that led to additional customer data impact." The categories Fireworks lists:

• Resource metadata: identifiers, display names, descriptions and creation times.
• Billing information: billing and shipping addresses, invoice and payment history, account balance and credit usage. Fireworks says it does not store card numbers.
• Model weights and datasets: "for certain customers, a subset of incomplete model weights and datasets were accessed."

Fireworks ties the attack to a financially motivated group selling stolen model access, a practice called LLMJacking. A Google Threat Intelligence Group and Mandiant report published November 2 says such incidents have produced fraudulent charges above $100,000 in a single day, and up to $1 million at some organizations before access was cut. It is the same playbook behind the Northflank breach. Neither Fireworks bulletin names Notion, and neither says which intrusion reached Notion's data.

What Notion Data Was Exposed?

Notion AI chat transcripts that had been sent to Fireworks for the Insights feature were exposed, according to Notion. The advisory gives this timeline:

• November 2, evening: Fireworks reported a small dataset accessed. Notion found "Notion AI synthetic testing data, and no Notion AI customer data."
• November 3, morning: Notion disconnected from Fireworks, deleted all data in the Fireworks system and, per its FAQ, halted all training runs.
• November 6: Fireworks said attackers "may have accessed potential customer data."
• November 8: Fireworks confirmed the new dataset.

Notion's incident FAQ defines the scope bluntly: "Any input to or output from the model that was written to the chat is included in that chat transcript." AI Meeting Notes were not affected unless used as chat input. Notion also used Fireworks to serve open weight models.

For most affected workspaces, Notion calls the transcripts unattributable, meaning "the chats weren't labeled with who wrote them or which workspace they came from, and the transcripts did not contain tool call results." That word carries more weight than it can bear: a chat asking the model to rewrite a contract for a named client names the company without any label. Notion's own guidance concedes as much, telling owners the "specific input or output from the model may contain sensitive data" and shipping an annotated export with an __analysis column that flags potential secrets.

Why Were Notion AI Chats Stored at Fireworks?

The chats were there because Insights, a dashboard that shows admins how their members use AI, runs on stored conversations, and Notion's zero data retention promise does not cover stored features. Notion's FAQ says its enterprise ZDR commitment "applies to the API requests we send to third party model vendors we use to generate responses to Notion AI requests." Features like chat history and Insights are different: "Our zero data retention commitments are not intended to cover these use cases where we are required to retain the data to deliver the feature."

For Insights, Notion "sent the stored requests and responses from Notion AI use to a third party model provider, Fireworks in this case." Fireworks "provided us with a contractual commitment to zero data retention for our use of its platform. Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used."

Put that next to Fireworks' own update, published the same day. Fireworks says its Inference, Training SDK and Nexus products "are all zero data retention (ZDR) by default," with no impact detected, while "a subset of incomplete model weights and datasets were accessed" for certain customers. Neither company has said which Fireworks product the Insights jobs ran on, so the gap between ZDR by default and data that was retained stays unexplained.

For engineers buying inference, ZDR is a property of a specific API path, not of a vendor. Batch jobs, evaluation runs and uploaded datasets are separate paths, and a ZDR contract should name which ones it covers. Notion says it is now auditing critical vendors, including inference providers, for zero data retention compliance.

Was Fireworks on Notion's Subprocessor List?

Yes. Notion's List of Subprocessors names Fireworks with the purpose "Compute infrastructure for serving large language models and powering AI services" and the location "Global." On November 12, 2026, the page (last updated November 5) still listed Fireworks, though Notion says it stopped sending data there by November 3. Nine entries in its main infrastructure table describe hosting or serving large language models: Anthropic, OpenAI, Google, xAI, Cerebras, Parallel Web Systems, Baseten, Modal and Fireworks.

Most coverage of AI vendor risk focuses on disclosure. DataGrail found that 63.6% of AI vendors do not name their AI subprocessors in their legal documentation. Notion did name Fireworks, and it did not help. The list told customers Fireworks could touch their data; it did not say Insights shipped stored chats there, outside the ZDR promise.

The page also has a notice mechanism: customers who email Notion with the subject "Subscribe to New Subprocessors" get notice of any new subprocessor and "ten (10) days to submit a legitimate, good-faith objection." That covers new vendors, not what an existing vendor keeps.

What This Means for Your Inbox

Notion AI can read your email if you connect it. Its AI Connectors page lists Gmail and Microsoft Outlook among supported apps and says "The Gmail AI Connector (personal) is free to connect for all plans." The advisory says that for most affected workspaces the exposed transcripts did not contain tool call results, which suggests the raw messages a connector fetched were not part of the leak.

The chat itself is another matter. If you pasted an email thread into Notion AI and asked for a reply, or Notion AI wrote a summary of your inbox into the conversation, that text is the kind of content Notion says was exposed. Notion has not said whether any exposed transcripts contained email content. Pasting a message into an AI chat is closer to forwarding it to an outside company than to keeping it in your inbox.

Notion's relationship with email has privacy wrinkles of its own, which we covered when we looked at whether Notion tracks your email.

What Should Notion Users Do Now?

Notion says "If neither you nor your workspace owner has heard from us, we haven't identified your workspace as affected, and no action is needed right now." If you were notified, follow the Notion FAQ:

1. Open the review screen. Workspace owners go to the sidebar, then ?, then Security incident review, in a desktop browser on the latest Notion version. The data is not available on mobile.
2. Pull the member list. Download affected members produces a CSV with names, emails, membership status, user IDs and a count of affected rows per person. Copy link lets members review only their own data.
3. Read the actual text. Owners with a verified domain can download affected_content.csv and affected_content_annotated.csv. Search them for client names, email threads and secrets.
4. Rotate credentials. Notion's advice: if anyone pasted "passwords, API keys, or other credentials into Notion AI during this timeframe," rotate them right away. Our Warp breach writeup gives the same advice for tokens pasted into AI agent sessions.
5. Review model providers. On Business and Enterprise plans, the Controls tab in Notion AI settings lets owners "Choose which model providers and models people can use with Notion Agent and Custom Agents." Notion notes that restricting a provider "changes the quality and efficiency of Auto."
6. Get retention terms in writing. Compliance teams should ask Notion which AI features store requests and responses, which subprocessors receive them, and whether ZDR applies to each path, then subscribe to subprocessor notices.

What We Could Not Verify

Notion gives a percentage, not a count, and no dates for the transcripts. Fireworks has not named the cloud provider, said how many customers lost datasets, or named any other affected customer; BleepingComputer and The Record identify only Notion. No source says which of the two October intrusions reached Notion's data, or which Fireworks endpoint retained it.