🔍 Read the full analysis: How Notion Says A Fireworks Breach Exposed AI Chat Transcripts on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Notion says data accessed in a Fireworks AI breach included stored Notion AI chat transcripts used for its Insights feature, affecting fewer than 1% of Notion workspaces. Notion says Fireworks had promised zero data retention but retained data from the endpoints Notion used; it revoked exposed Notion API keys found in affected messages on November 11.
Notion says a dataset accessed in the Fireworks AI breach included chat transcripts from its AI service, prompting the company to revoke exposed Notion API keys found in affected user messages on November 11. Notion says fewer than 1% of workspaces were affected and that Fireworks had given it a contractual zero-data-retention commitment, but data was retained from the endpoints Notion used.
Notion’s updated security advisory says the exposed dataset included Notion AI chat transcripts used for its Insights feature, which gives workspace administrators information about how teams use AI. Notion said the transcripts were unattributable for the vast majority of affected workspaces: they were not labeled with the writer’s identity or workspace, and did not include tool-call results. That does not mean the text was necessarily nonsensitive. Notion defines a transcript as any input or output written to the chat, and advises affected customers to review the data because it may contain sensitive information.
Notion says it used Fireworks for Insights classification work and as an inference provider for open-weight models in its product. It says the transcripts in question came from the Insights work. On November 11, Notion also said it had revoked exposed Notion API keys found in affected user messages. For workspaces identified as affected, the company recommends treating the data as exposed, reviewing it under its Security incident review guidance, and rotating passwords, API keys, or other credentials that may have been pasted into Notion AI during the incident.
The company says fewer than 1% of Notion workspaces were affected. It says AI Meeting Notes were not affected unless audio, transcripts, or summaries were later used as input in a Notion AI chat transcript. Notion also says no other Notion features were affected. Those statements describe the company’s current account of the incident; the published material does not identify the Fireworks system that retained the data or explain how long it was stored.
How Notion Says a Fireworks Breach Exposed AI Chat Transcripts
Notion says data retained by Fireworks included stored Notion AI chat transcripts used for Insights. The incident highlights the risks of sending stored conversations to AI vendors.
What was exposed
Notion says the accessed dataset came from its Insights analysis of stored AI requests and responses.
Chat text
Inputs and outputs could contain sensitive information, including credentials pasted into a chat.
Usually unlabeled
Notion says most affected transcripts lacked writer and workspace labels and did not include tool-call results.
Limited features
Notion says no other features were affected. AI Meeting Notes were affected only if their content was later used in an AI chat.
How the vendor workflow differed
Notion says the exposed data came from stored chats used for Insights, not live requests used to generate responses.
- Stored requests and responses sent to Fireworks for classification.
- Notion says data was retained from the endpoints it used.
- Fireworks also provided inference for open-weight models.
- Notion says that workflow was not the source of the exposed transcripts.
Incident response
Notion says it disconnected from Fireworks and deleted its data from the system.
On November 3, Notion says it stopped communications and halted training runs.
Notion updated its advisory on November 10 and 11 as it learned more about the dataset.
On November 11, Notion said it revoked exposed API keys found in affected messages.
What affected customers should do
Notion advises workspaces it has identified as affected to treat the data as exposed.
- Review the data using Notion’s security incident guidance.
- Rotate passwords, API keys, and other credentials that may have been pasted into chats.
- Notion says users not contacted by the company or their workspace owner have not been identified as affected.
Why Stored AI Chats Matter
The incident puts a focus on the difference between live AI requests and data retained for product features. Notion says its zero-retention commitment for model requests was not intended to cover stored chat history and Insights data, which it says are retained to provide those features. For Insights, Notion sent stored requests and responses to Fireworks for analysis, and says Fireworks had contractually committed not to retain data from its use of the platform.
Notion’s account says data was nevertheless retained from the Fireworks endpoints it used. That matters to businesses and users who may place internal material into AI chats: transcripts can include prompts and model responses, and may contain credentials or other sensitive content. Notion’s guidance to review affected data and rotate credentials reflects that exposure risk, even though the company says most affected transcripts could not be tied to a specific person or workspace.
The breach also raises a vendor oversight issue for organizations using AI features through workplace software. Notion says it is auditing critical vendors, including inference providers and data processors, to check their data-minimization practices and zero-retention policies. The company has not published the audit’s findings.
Popular right now
iRobot Roomba Plus 405 (G181) 2-in-1 Vacuum and Mop Robot with AutoWash Dock
KitchenAid Classic Series 4.5-Quart Tilt-Head Stand Mixer, Onyx Black
Roborock Robot Vacuum and Mop with LiDAR Navigation and Self-Empty Dock
As an affiliate, we earn on qualifying purchases.
How Notion Used Fireworks
Notion’s updated notices describe two uses of Fireworks: classification jobs for Insights and inference for open-weight models in Notion’s product. The company says the exposed data came from the Insights use, where stored requests and responses were analyzed. Its explanation distinguishes that stored-data workflow from live requests sent to model vendors to generate Notion AI responses.
In its incident timeline, Notion says Fireworks contacted it on November 2 about access to a small set of data, initially identified as Notion AI synthetic testing data. Notion says it disconnected from Fireworks on November 3, deleted its data from the Fireworks system, stopped communications between the systems, and halted training runs. Notion then updated its advisory on November 10 and 11 as it learned more about the dataset. Fireworks’ own bulletin was last updated November 9, according to the source material.
Fireworks said its update had not detected an impact to Inference, Training SDK, and Nexus, which it described as zero-retention by default. It also listed datasets among data accessed for certain customers. The published statements do not explain how those descriptions relate to Notion’s account that data from the endpoints it used was retained.
“Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.”
— Notion, in its security advisory
Open Questions About Retention
The public notices do not say which Fireworks system retained the data, how long it was retained, or how many individual users were affected. Notion gives a workspace figure—fewer than 1%—but does not provide a user count. It is also not clear whether other Fireworks customers had data retained in the same way.
The companies’ descriptions leave an unresolved technical question. Notion says data from the endpoints it used was retained despite a contractual zero-retention commitment; Fireworks says it has not detected an impact to several services that it describes as zero-retention by default and separately lists datasets among accessed data for certain customers. The available statements do not identify the relevant endpoint or system, so they do not establish how the two accounts fit together.
Notion says most affected transcripts could not be attributed to a person or workspace, but it also warns that chat text may contain sensitive information. The notices do not provide a transcript-by-transcript account of what content appeared in the dataset or specify how many messages included credentials.
Notion’s Vendor Audit
Notion says it is auditing critical vendors, including inference providers and data processors, to check data-minimization practices and zero-retention policies. The company has not announced a completion date or published findings. A fuller account of the audit, and any technical explanation from Fireworks about where the retained data was stored, could clarify the gap between the contractual promise and the reported retention.
Users whose workspaces Notion has identified as affected should follow the company’s incident-review guidance and rotate credentials that may have appeared in chats. Notion says people who have not been contacted by the company, or by their workspace owner, have not been identified as part of the affected group. The scope remains subject to the companies’ ongoing investigation and any further notice they issue.
Key Questions
What did Notion say was exposed?
Notion says the dataset accessed in the Fireworks breach included Notion AI chat transcripts used for Insights. It defines transcript content as inputs to and outputs from the model written in the chat.
How many Notion workspaces were affected?
Notion says fewer than 1% of workspaces were affected. It has not published a count of individual users or messages.
Were AI Meeting Notes affected?
Notion says AI Meeting Notes, including audio, transcripts, and summaries, were not affected unless that material was used as an input in a Notion AI chat transcript.
What should affected users do?
Notion advises affected users to treat the data as exposed, review it under the company’s Security incident review guidance, and rotate passwords, API keys, or other credentials that may have been pasted into Notion AI during the incident.
What is still unknown about the breach?
The notices do not identify which Fireworks system retained Notion’s data, how long it was stored, how many people were affected, or whether other Fireworks customers experienced the same issue.
Source: ThorstenMeyerAI.com
