Notion AI chat transcripts exposed in Fireworks breach

The Fireworks AI breach now has a name-brand victim. Notion says the attack on its AI infrastructure provider exposed Notion AI chat transcripts in a small number of workspaces. Notion's systems were not breached. The data sat with a vendor most Notion users had never heard of. If your business runs on SaaS with AI built in, this is the breach pattern to plan for: your vendor's vendor.

What actually happened

From Notion's security advisory, last updated November 11:

• What leaked: a dataset with Notion AI chat transcripts used for Insights, the feature that classifies how a workspace uses AI. Notion says no other features were affected.
• How many: under 1% of Notion workspaces. The investigation is ongoing.
• What the transcripts held: for most affected workspaces, they were unattributable, meaning not labeled with the user or workspace. They did not contain tool call results. But a transcript can still name a company in its own text.
• Timeline: on November 2, Fireworks told Notion the accessed data was synthetic test data only. By the morning of November 3, Notion had disconnected from Fireworks and deleted all of its data there. On November 6 Fireworks said customer data may have been accessed. On November 8 it confirmed the final dataset, and Notion found the transcripts. Notion contacted affected customers on November 9.
• What changed: Insights is disabled, and Notion no longer serves open-weight models through Fireworks.

On the Fireworks side, BleepingComputer reports that an attacker breached a third-party cloud provider that hosted Fireworks R&D machines on October 23, then ran an unauthorized workload on those machines. We covered what Fireworks lost on Monday.

Why it matters for your business

Count the hops: Notion, then Fireworks, then a cloud provider nobody has named. Your team typed into a Notion chat box. That text ended up three companies away, kept for an analytics feature, not just used to answer the question.

Notion's advice is plain: if anyone pasted passwords, API keys or other credentials into Notion AI during the incident window, rotate them. If you got no email from Notion, it says no action is needed right now.

What we would do for every AI feature your business uses:

1. Read the subprocessor list. Who runs the model, and who hosts their machines?
2. Ask what is stored, and why. Inference that answers and forgets is one risk. A copy kept for "insights" or training is another.
3. Turn off what you don't use. Admin analytics on AI chats is a dataset. If no one reads it, don't let it exist.
4. Keep secrets out of chat. Use a password manager or vault, never a prompt.

Sources: Notion, BleepingComputer.