Notion Flags AI Chats in Fewer Than 1% of Its Workspaces

Notion is telling owners of fewer than 1% of its workspaces to treat certain Notion AI chat transcripts as exposed and rotate any credentials found in them after an attack on Fireworks AI.

Notion said attackers reached data held by Fireworks AI, the inference provider it used behind the scenes. The company said its own systems were not breached; the exposed material sat with the vendor that operated behind Notion’s product.

For affected customers, the vendor compromise functions like a compromised cloud host: data crossed a system they did not directly administer. VentureBeat wrote that an AI-provider breach “can reach businesses that use its technology through someone else’s software.” Notion disabled the affected feature and stopped sending traffic to Fireworks.

What did the Fireworks breach expose?

Notion said Fireworks performed two jobs for the product: classification work for Insights, which shows customers how their teams use AI, and general inference to serve open-weight models inside Notion. The exposed dataset consisted of Notion AI chat transcripts used for Insights.

For most affected workspaces, Notion described those chats as “unattributable.” They carried no label for the author or workspace and included no tool-call results. “Beyond what’s in the chat transcript itself, there’s no information tying the chat back to workspaces, users, or companies,” Notion said.

The Register noted that the transcript text can still contain identifying details. Notion’s notice also identified a direct remediation risk: employees at some companies pasted passwords or API keys into Notion AI, placing those secrets inside messages processed by the inference provider.

The missing attribution labels do not remove content-level risk. A chat without a user or workspace label can still carry a password, an API key or details that identify the person who wrote it.

Affected owners can inspect the material through a security incident review in Notion’s desktop web interface, BleepingComputer reported. The review gives them a way to check exposed content and identify credentials that need rotation.

How did Notion respond?

Fireworks first notified Notion on the evening of Nov. 2, 2026. Notion’s response unfolded in six documented stages:

• Nov. 2: Fireworks said a small set of data had been accessed. It contained Notion AI synthetic testing data and no customer data.
• Nov. 3: By the next morning, Notion had disconnected its systems from Fireworks and deleted all of its data there.
• Nov. 6: Fireworks warned Notion that customer data might be involved.
• Nov. 8: Fireworks confirmed the final impacted dataset, two days after issuing that warning.
• Nov. 9: Notion began contacting affected customers.
• Nov. 11: Notion revoked exposed Notion API keys that its investigators found in affected user messages.

The sequence changed Notion’s task from deleting vendor-held test data to warning customers and revoking credentials. The key revocations addressed Notion API keys visible in the exposed messages; the broader cleanup still falls on owners of affected workspaces.

What happened at Fireworks AI?

Fireworks has more than 10,000 customers, The Record reported. The company disclosed two October incidents, and a WebProNews timeline extended the first event back to Oct. 6.

• Oct. 6: Fireworks detected unauthorized credential use, according to the timeline.
• Oct. 9: Fireworks reported its first incident, which involved stored secrets such as those used in evaluation jobs.
• Oct. 23: A third-party cloud provider hosting Fireworks’ R&D machines was hit.
• Oct. 24: The intruder used that access to reach Fireworks development machines and “run an unauthorized workload that led to additional customer data impact,” Fireworks said in its Nov. 9 bulletin.

Fireworks described the Oct. 23-24 cloud-provider path as a separate incident that produced additional customer-data impact. Its Nov. 9 bulletin said the affected data included:

• Resource metadata.
• Billing details such as addresses and invoice histories.
• Incomplete model weights and datasets for some customers.

Fireworks said it does not store payment card numbers. The company also said it had not detected an impact to its Inference, Training SDK and Nexus products, which are zero data retention by default.

Lin Qiao, Fireworks’ co-founder and chief executive, said the intruders did not appear to be hunting for customers’ models. “From what we see attackers are not after weights,” she said, as quoted by The Register. “Most downloads were partial and stopped.”

Fireworks brought in Palo Alto Networks’ Unit 42, notified law enforcement and disabled self-serve dataset uploads and downloads for Batch Inference and dataset-based training while it investigated.

The widened disclosure came days after Fireworks hired Dave Wehner, Meta’s former chief financial officer, as its chief financial officer.

Why does the incident matter for AI security?

Fireworks said the evidence points to a financially motivated group that sells tokens obtained through unauthorized access to large language models. The group routes stolen model capacity through illicit gateways, a practice known as LLMJacking.

Google Threat Intelligence Group and Mandiant described the trend in a Nov. 2 report. It cited fraudulent charges above $100,000 in a single day and cumulative bills that reached $1 million at some organizations before access was revoked.

Wiz counted at least nine AI developer platforms that disclosed incidents in October, VentureBeat reported. The scale broadens the issue beyond Fireworks: the company serves more than 10,000 customers, and researchers have documented a monetization scheme across multiple hosted-AI providers.

WebProNews also cited a related pattern the previous month, when Symantec’s honeypot caught an attack agent built to run on other people’s exposed AI models. Together, the reports connect stolen model access to billable token sales and make infrastructure vendors part of enterprise AI security planning.

What remains unresolved?

For Notion, the episode follows an October push to deepen its AI features. WebProNews reported that the company rebuilt its agents and moved Notion AI to a new credit system.

Both companies said their investigations remain open. Fireworks warned that its work “may reveal additional information.” Notion has already disabled the affected feature, stopped traffic to Fireworks, deleted vendor-held data and contacted affected customers.

Until Fireworks and Notion close their probes, the affected customer count and the full inventory of exposed transcripts, billing metadata and model artifacts remain open to revision. Notion customers must treat any credential found in an affected chat as compromised and rotate it.