Fireworks AI Breach Exposed Notion AI Chat Transcripts

Fireworks AI says an attacker got into one of its development systems through a third-party cloud provider. Notion, which used Fireworks to run its Insights feature, now says that stolen data included Notion AI chat transcripts for fewer than 1% of its workspaces. Notion says its own systems were not breached. Fireworks last updated its bulletin on November 9, Notion’s advisory has been revised since November 10, and TechCrunch covered it on November 12.

The timeline, in both companies’ dates

Notion’s advisory and Fireworks’ bulletins cover different parts of the chain, so I’ve put every date in one table and kept the source beside it.

Date (2026)	What happened	Source
Oct 6	Fireworks finds unauthorized use of internal credentials. Environment variables in evaluation jobs were captured for a limited number of accounts.	Fireworks, October bulletin
Oct 23	A third-party cloud provider hosting Fireworks’ R&D machines has a security incident.	Fireworks, November update
Oct 24	An unauthorized party uses that access to reach Fireworks development machines and runs a workload that causes more customer data impact.	Fireworks, November update
Nov 2	Fireworks alerts Notion to an accessed dataset. Notion’s first review finds only synthetic test data.	Notion advisory
Nov 3	Notion disconnects from Fireworks and deletes the data in Fireworks’ system.	Notion advisory
Nov 6	Fireworks tells Notion that malicious actors may have accessed potential customer data.	Notion advisory
Nov 8	Fireworks confirms the final dataset. Notion finds Insights chat transcripts in it.	Notion advisory
Nov 9	Notion contacts affected customers.	Notion advisory
Nov 11	Notion revokes Notion API keys it found in affected user messages.	Notion advisory

The October bulletin dates its timeline in Pacific time. Notion's advisory lists two notices from Fireworks: a small dataset on November 2, which turned out to be synthetic test data, and possible customer data on November 6. BleepingComputer also reports the November 2 alert.

What Fireworks says was taken

Fireworks’ November 9 update lists three kinds of data. The first is resource metadata: identifiers, display names, descriptions and creation times. The second is billing information, including addresses, invoice and payment history, account balance and credit usage. Fireworks says it does not store payment card numbers, and those were not affected. The third, for certain customers, is a subset of incomplete model weights and datasets.

Fireworks says it has found no impact on Inference, the Training SDK or Nexus, which it describes as zero data retention by default. It has also turned off self-serve dataset uploads and downloads for Batch Inference and dataset-based training while it investigates.

Fireworks attributes the activity to a financially motivated group that sells tokens taken from LLM access to “illicit routing gateways.” It calls that LLMJacking, and it points to a Google Threat Intelligence Group and Mandiant report on the practice from November 2. The same bulletin says that, as of October 25, Fireworks had seen no further unauthorized access to the platform customers use. That date is two weeks before the Notion dataset surfaced on November 8, and the bulletin doesn’t say whether the check was repeated.

One breach, or two?

TechCrunch calls this the second breach affecting Fireworks in as many months, after an October incident. Fireworks’ own pages don’t put it that way. The October 6 credential incident and the October 23 to 24 cloud-provider access both fall in October, and the November update files the later activity under the October incident heading. My read: the November disclosure is an update to the October incident, not a new one.

I checked the count against Fireworks' October bulletin and its November update. BleepingComputer treats the two events as separate, both in October, and doesn't use the two-months framing.

What Notion’s chats were, and weren’t

Notion’s advisory describes two uses of Fireworks. The first was classification jobs behind Insights, a feature that shows workspace admins how their teams use AI. The second was general inference for open-weight models inside Notion AI. The stolen transcripts came from Insights. Notion says they include “any input to or output from the model that was written to the chat.”

Notion says the transcripts were unattributable for the vast majority of affected workspaces: they weren’t labeled with who wrote them or which workspace they came from, and they had no tool call results. It says nothing beyond the chat text links a transcript to a user, workspace or company. That phrase means some affected workspaces were attributable. Notion says customers can review their own impacted data inside the workspace.

Notion’s advice is direct. Treat the data as exposed, and rotate any passwords, API keys or other credentials pasted into Notion AI during the incident window. It has since revoked Notion API keys it found in affected messages. Insights is turned off, and Notion has stopped serving open-weight models through Fireworks.

My read

My read: the lesson here is not that Notion’s security failed. Notion says it wasn’t breached, and its advisory repeats that point. The problem is the chain. A person types into a Notion chat, Notion sends that text to a classification vendor, and the vendor’s development machines sit behind a cloud provider that got hit. Three companies end up holding the same sentence, and the user only knows the name on the product.

My read is that anyone who pastes sensitive material into an AI feature inside a SaaS tool should assume the chat box keeps a copy somewhere else. Live API keys, passwords and client data don’t belong in a chat window you wouldn’t paste into a shared document. Zero retention is narrower than it sounds. Fireworks names inference, the Training SDK and Nexus as zero retention by default. It doesn’t name the batch and dataset path, which is the path it has now shut for self-serve uploads. My read: that makes zero retention a promise about specific products, not about every job a vendor runs for a customer.

My read: Notion’s cutoff on November 3 was the right move, but it could only stop future exposure. Data already taken stays taken, and that’s the uncomfortable part of any vendor breach.

Fireworks was one of the hosts named for Meta’s Muse Spark Open when it launched in October, as our Muse Spark license post notes. If your product runs open models through a host, ask that host where prompts and datasets are stored, and who can reach them.

Note on sources: I read Fireworks' October bulletin and its November 9 update in full, plus Notion's advisory and both the TechCrunch and BleepingComputer articles. I didn't open Notion's FAQ, which both outlets cite for its zero-retention wording, so I haven't relied on that wording. Notion gives the affected share only as fewer than 1% of workspaces, with no count. Fireworks' investigation is ongoing, and it says it may find more.

A breach at Fireworks AI exposed Notion AI chat transcripts. Notion's own systems were never touched.