Notion said a security incident at Fireworks AI, a third-party inference provider, included Notion AI chat transcripts used for the company’s Insights feature, and that fewer than 1% of Notion workspaces were affected. The company published a security advisory dated Nov. 12 and updated it the same day. TechCrunch also reported the disclosure.
Fireworks notified the company on the evening of Nov. 2 that malicious actors had accessed a small set of data that, Notion said, included only Notion AI synthetic testing data. By the morning of Nov. 3, Notion said, it had disconnected from Fireworks. It said it deleted all of its data in the Fireworks system on Nov. 4. On Nov. 6, Fireworks notified Notion that malicious actors may have accessed potential customer data. Notion said Fireworks confirmed the final impacted dataset on Nov. 8, and that Notion contacted impacted customers on Nov. 9.
“Upon analysis of the dataset Fireworks AI gave us on November 8, we discovered that it included Notion AI chat transcripts used for the Insights feature, which for the vast majority of impacted workspaces were unattributable,” Notion said. It defined “unattributable” as chats that were not labeled with who wrote them or which workspace they came from, and that did not contain tool-call results. “Beyond what’s in the chat transcript itself, there’s no information tying the chat back to workspaces, users, or companies,” the advisory said. Notion said no other Notion features were affected, and that “this was not a breach of our systems.”
Notion said it used Fireworks for classification jobs that powered Insights and as a general inference provider for open-weight models. It said Insights has been disabled and that it is no longer serving open-weight models through Fireworks. Affected customers, it said, can review the impacted data inside their workspace. Notion recommended that they “treat this data as if it were exposed” and rotate credentials pasted into Notion AI during the incident window. It later said it revoked exposed Notion API keys and reported third-party keys to the vendors that issued them. Customers who have not been contacted, Notion said, have not been identified as affected.
Fireworks, in a Nov. 9 update to its October incident bulletin, said a later intrusion through a third-party cloud provider reached some customer billing information and, for a limited set of accounts, secrets, datasets, and incomplete models. It said it has not detected an impact to inference, its training SDK, or Nexus, which it said are zero-data-retention by default. That bulletin does not name Notion or discuss chat transcripts. The earlier Fireworks disclosure was covered by AI Tech Daily.