🔍 Read the full analysis: How The Fireworks Breach May Have Exposed Notion AI Conversations on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Notion says a dataset accessed in the Fireworks AI breach included stored Notion AI chat transcripts used for its Insights feature. The company says fewer than 1% of workspaces are affected and that it revoked exposed Notion API keys found in affected messages on November 11. The companies have not said how long the data was retained or which Fireworks system stored it.
Notion says chat transcripts from its AI product were included in a dataset accessed by attackers in the Fireworks AI breach, expanding the scope of the incident beyond the synthetic testing data first identified. The company says the data related to its Insights feature and affected fewer than 1% of Notion workspaces; it also says it revoked exposed Notion API keys found in affected user messages on November 11.
In an updated security advisory and help page, Notion said the dataset Fireworks provided on November 8 included Notion AI chat transcripts used for Insights, a feature that gives workspace administrators information about how teams use AI. Notion said transcripts for most affected workspaces were “unattributable”: they were not labeled with the writer or workspace and did not include tool-call results.
That description does not mean the chat content was empty or harmless. Notion defines a transcript as any input to or output from the model that was written to the chat. The company cautioned that this material could contain sensitive information and advised affected users to review it. It said AI Meeting Notes were not affected, unless audio, a transcript or a summary was used as input in a Notion AI chat. Notion said no other features were affected.
Notion said it learned during its investigation that data had been retained from Fireworks endpoints, despite a contractual commitment to zero data retention. On November 11, it revoked exposed Notion API keys found in affected user messages. The company advises affected users to treat the data as exposed, review it through its Security incident review process and rotate passwords, API keys or other credentials that they entered into Notion AI during the incident.
Notion AI chats in the breach What affected users need to know
Notion says attackers accessed stored AI chat transcripts used for its Insights feature. The disclosure expands the incident beyond synthetic testing data.
What was exposed
The dataset contained stored requests and responses from Notion AI chats used for Insights.
Inputs and outputs
Transcripts may contain sensitive details users entered into chats.
Often unattributable
Most affected transcripts lacked writer and workspace labels and tool-call results.
Insights data
Notion says the dataset came from Insights analysis, not its general inference service.
Incident timeline
What users should do
- Affected workspace owners should review data through Notion’s Security incident review process.
- Rotate passwords, API keys or other credentials entered into Notion AI during the incident.
- AI Meeting Notes were not affected unless their audio, transcript or summary was used as input in a Notion AI chat.
What remains unclear
The public notices leave key details unresolved for organizations assessing their exposure.
The Risk to Workspace Conversations
The disclosure matters because people may enter customer names, contract details or credentials into AI chats on the assumption that prompts are handled only to produce an answer. Notion’s notice says stored requests and responses used for Insights were part of the accessed dataset. Even when transcripts lack labels identifying a person or workspace, their contents may still be sensitive.
The incident also highlights a distinction in how Notion describes its zero-retention safeguards. The commitment applies to live requests sent to third-party model providers to generate responses, Notion says. It does not cover every feature that relies on keeping information, including chat history and Insights. Notion says it sent stored requests and responses to Fireworks for analysis and believed the vendor’s contractual commitment covered its use of the platform. The breach raises questions about how retention promises are implemented and checked across vendor systems.
For affected organizations, the immediate concern is not limited to whether a transcript identified its author. A user-entered secret may remain sensitive regardless of attribution. Notion’s advice to examine affected data and rotate credentials reflects that risk, but the company has not publicly specified how many individual users or messages were involved.
Popular right now
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
Sony BRAVIA 6 65-Inch OLED 4K HDR Smart Google TV with Gemini (K-65A60)
Vitamix 5200 Blender with 64 oz Container, Black
As an affiliate, we earn on qualifying purchases.
How Notion’s Fireworks Use Worked
Notion said it used Fireworks for two purposes: classification jobs for Insights and as an inference provider for open-weight models within its product. According to Notion, the exposed dataset came from the Insights work, rather than from the general inference service. It described the dataset as stored requests and responses from Notion AI use that Fireworks analyzed for the feature.
The timeline in Notion’s updated notice says Fireworks told the company on the evening of November 2 that a small amount of data had been accessed by malicious actors. Notion initially identified that material as synthetic testing data. On November 3, it says it disconnected its systems from Fireworks, deleted data from the Fireworks system and halted training runs. Fireworks’ own bulletin, according to the source material, was last updated November 9 and said certain customer datasets had been accessed.
Notion revised its advisory on November 10 and 11 after learning more about the dataset. BleepingComputer reported the transcript disclosure on November 11. The updated information changes the practical advice for users: the material may include real chat inputs or outputs, not just test data.
“Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.”
— Notion, in its security advisory
Key Details Still Missing
Notion has not identified publicly which Fireworks system retained the data, how long it was stored, or how many people and messages were involved. The company’s estimate covers fewer than 1% of Notion workspaces, but it has not provided a specific count. It says users or workspace owners who have not heard from Notion have not had their workspace identified as affected; that is not a public account of the total number of exposed transcripts.
There is also an unresolved difference in the companies’ published descriptions. Fireworks’ November 9 update said it had not detected an impact to Inference, Training SDK and Nexus, which it described as zero-retention by default, while listing datasets among information accessed for certain customers. Notion has not said which endpoint or system held its data, and the available statements do not explain how the retained Insights data relates to Fireworks’ description. It is also not known whether other Fireworks customers experienced a similar retention issue.
Vendor Audit and User Reviews
Notion says it is auditing critical vendors, including inference providers and data processors, to check their data-minimization practices and zero-retention policies. It has not announced a completion date or published the results of that review. The company’s next public updates may clarify the affected systems, retention period and scale of the exposure.
Notion advises affected workspace owners to use its Security incident review process to examine the data and to rotate any passwords, API keys or other credentials that may have been entered in chats during the incident. Users who receive a notice from Notion should follow the company’s instructions and assess the specific content involved. The scope and technical cause remain under investigation; neither company has yet provided a public explanation of how the data was retained despite the stated commitment.
Key Questions
What Notion information was included in the dataset?
Notion says it included Notion AI chat transcripts used for Insights, made up of inputs to and outputs from the model written to the chat. The company says transcripts for most affected workspaces lacked labels identifying the writer or workspace.
How many Notion workspaces are affected?
Notion says fewer than 1% of workspaces are affected. It has not provided an exact number of workspaces, users or transcripts.
Were AI Meeting Notes exposed?
Notion says AI Meeting Notes, including audio, transcripts and summaries, were not affected unless that material was used as input in a Notion AI chat transcript.
What should affected users do?
Notion advises affected users to treat the data as exposed, review it through the Security incident review process and rotate credentials they entered into Notion AI during the incident, including passwords and API keys.
Why is the zero-retention commitment in question?
Notion says Fireworks had made a contractual zero-data-retention commitment, but its investigation found data retained from the endpoints Notion used. The companies have not explained which system stored the data or for how long.
Source: ThorstenMeyerAI.com
