News · 2026-11-10

Notion says Fireworks incident exposed a dataset of AI chat transcripts

Notion says a security incident involving its AI provider Fireworks affected a dataset containing customer AI chat transcripts used for Insights classification. Fewer than 1% of Notion workspaces may have been affected, the company says, and it advises affected customers to treat the material as exposed.

Key facts

• Notion says Fireworks confirmed the customer dataset to it on November 8, 2026.
• Fewer than 1% of workspaces may have been affected, according to Notion.
• Fireworks disclosed broader customer-data categories in a November 9 update.
• Primary source: Notion’s security advisory.

Notion says it used Fireworks for Insights classification and also for general inference with open-weight models. It identifies the affected customer dataset as transcripts used for Insights; the exact storage location and retention path are not public. The reviewed evidence does not establish the download size or runtime memory of those separately mentioned models.

The company says the vast majority of affected transcripts lacked user and workspace labels and tool-call results. That narrows what was described, but removing a name tag does not make the words in a conversation anonymous. A pasted password, a customer name, or a distinctive project could still identify the author or reveal sensitive information. Notion tells affected users to rotate credentials pasted into chats and inspect their data securely.

Fireworks’ update reports two October activity windows: access to environment variables in evaluation jobs on October 6, and access to development machines following a third-party cloud-provider incident on October 23, with an unauthorized workload on October 24. Its expanded disclosure includes some secrets, datasets, and incomplete model artifacts, but does not map each category to a particular event. The sequence should not be mistaken for a fully reconstructed attack chain.

Fireworks says its Inference, Training SDK and Nexus products are zero-data-retention by default and that it found no impact to those products. A zero-retention setting for named endpoints is like a rule for one room in a building: it does not describe every dataset, evaluation job, internal application, or downstream analytics workflow. The companies have not disclosed enough to locate the exact Insights transcript path or resolve its applicable retention terms.

Notion says it disconnected from Fireworks and deleted its data from Fireworks’ system by November 3, before the later confirmation of customer data. Deleting a provider-side copy does not establish that an attacker has deleted any copy they may hold. Fireworks describes its investigation as “Active monitoring,” not closed.

A Hacker News discussion raised the distinction between missing labels and meaningful anonymity. Some customers also reported notification friction; those individual reports are not a complete survey. Google Threat Intelligence and Mandiant describe the wider market for stolen access to AI services, but their general report does not independently attribute this particular incident.

Primary source, verified: read the paper →

Ground Truth. (2026, November 10). Notion says Fireworks incident exposed a dataset of AI chat transcripts. Ground Truth. https://groundtruth.day/news/notion-fireworks-ai-incident-transcripts.html

@misc{groundtruth:notion-fireworks-ai-incident-transcripts,
  title  = {Notion says Fireworks incident exposed a dataset of AI chat transcripts},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {nov},
  url    = {https://groundtruth.day/news/notion-fireworks-ai-incident-transcripts.html}
}

Topics: cybersecurity · ai-security · supply-chain · data-breach