Fireworks AI breach exposes Notion AI chats in fewer than 1% of workspaces

What happened, and when

Notion confirmed in an official statement a security incident at Fireworks AI, one of the largest AI infrastructure platforms in the world, used by tens of thousands of companies and hundreds of thousands of developers. Notion is one of those customers: it used Fireworks to run classifications for the Insights feature and as an inference provider for open-weight models within the product.

The timeline, according to Notion itself, is tight. In early November 2026, the company learned of a possible incident at Fireworks and, as a precaution, disconnected all its systems from the provider as early as November 3, deleted the data that was stored there, and stopped sending any traffic. On November 6, Fireworks notified Notion that malicious actors may have accessed customer data. On November 8, Fireworks confirmed this new set of compromised data.

From there, Notion's security team analyzed the material and concluded that fewer than 1% of the platform's workspaces may have been affected.

What leaked, and what didn't

The exposed data was a set of Notion AI chat transcripts used in the Insights feature, which helps customers understand their own AI usage within Notion. According to the company, these conversations were "non-attributable": they had no marking of who wrote them or which workspace they came from, and they contained no tool call results, such as Notion page content or external data pulled in by the AI.

In other words: aside from the conversation text itself, there was no metadata linking that chat to a specific company, user, or workspace. Notion emphasizes that no other data from within workspaces was affected, only these isolated transcripts used to train and calibrate the Insights function.

Even without direct attribution, the content of the conversation itself can be sensitive. If someone pasted an API key, password, or other secret into a prompt to Notion AI during the affected period, that text may be in the exposed batch, even without a name or email attached to it.

Who was notified and what to do now

Notion says it directly contacted the owners of impacted workspaces; anyone who was not contacted is not on the affected list and does not need to take action. For those who were notified, the verification path is through the workspace's side menu, under the help icon, in "Security incident review," available only on the desktop app or browser (it doesn't work on mobile).

The level of detail depends on the plan:

• Enterprise with managed members: the workspace owner gets access to a CSV with the affected data and an annotated version with extra metadata (marked with __metadata or __analysis), including which user is associated with each transcript, to facilitate their own internal investigation.
• Other plans: the workspace owner receives a page with a link to share with affected members, who then see a CSV containing only their own exposed data.

Notion's recommendation is direct: treat this data as if it had in fact been exposed, and immediately rotate any password, API key, or credential that was pasted into Notion AI during the incident window.

Insights disabled, open-weight inference suspended

In addition to cutting the connection with Fireworks, Notion disabled the Insights feature while it investigates and stopped serving open-weight models through the provider. The company also states it has halted all ongoing training that depended on Fireworks.

There's a detail that matters to anyone who has tested Notion's experimental features: customer data from LEAP (Learning and Early Access Program), a program in which users volunteer their own data for Notion to test new AI technology, was used in the past to train task-specific models running on Fireworks' infrastructure. There's no indication in the statement that the incident specifically reached this training pipeline, but it's the kind of use that explains why the company zeroed out the entire integration instead of just disabling a single feature.

What this changes for those who build (or integrate) with third-party AI

For those who develop products that depend on inference providers like Fireworks, Together AI, Groq, or similar, Notion's case is a practical reminder: outsourcing inference doesn't outsource responsibility for the data that passes through it. Notion processed usage classifications at an external provider, and even with supposedly anonymized data, a supply-chain incident still leaked real prompt content.

Three points deserve immediate auditing in any stack that sends user data to an external AI provider:

1. What exactly leaves your application: tool calls, page content, function results, all of this is sensitive data, even without a username attached.
2. Retention on the provider's side: how long the provider keeps logs and transcripts, and whether this is documented in a contract or security SLA.
3. A fast disconnection plan: Notion took less than a week between the first alert and the total cut of traffic with Fireworks; having this runbook ready before the incident is what separates a fast response from an improvised one.

For Brazilian teams that use Notion AI in corporate workflows, the practical takeaway is simpler: treat any secret pasted into an AI chat, whether Notion AI, Copilot, or corporate ChatGPT, as if it were text in a production log. Credential rotation after any vendor incident should be standard procedure, not the exception.

What remains unresolved

Notion's statement doesn't detail the root cause of the incident at Fireworks, nor how many total records were compromised outside the slice that touches Notion workspaces. The company also didn't provide a timeline for reactivating the Insights feature or say whether it intends to keep using Fireworks as an inference provider in the future. For technical updates straight from the provider, Notion itself points to Fireworks AI's official security updates, still without full public disclosure of the attack vector as of this article's publication.