Bottom line: Notion says a breach at its AI vendor, Fireworks AI, exposed some unattributable Notion AI chat transcripts. Notion says no pages, databases, files, or other workspace data were affected. The exposure depends on what people typed or pasted into Notion AI chats.
Last updated: November 10, 2026. The investigation is ongoing and this brief will be updated as facts change.
What happened
- Fireworks AI is a vendor that runs AI models for other software companies. Notion used it for background AI work.
- Fireworks disclosed a security incident in October 2026 and updated its bulletin on November 9. It says an unauthorized party used stolen credentials, then used access from a separate cloud-provider breach to reach development systems. It has engaged outside forensics and notified law enforcement. It attributes the activity to a financially motivated group that resells stolen AI access.
- On November 6, Fireworks told Notion that customer data may have been accessed. On November 8, Fireworks confirmed the dataset to Notion.
- Notion found the dataset included Notion AI chat transcripts used by its admin analytics feature, Insights. Notion notified affected workspaces on November 9 and 10 and says fewer than 1% of workspaces were affected.
What is and is not affected
Item | Status per Notion |
Pages, databases, files, CRM, dashboards, automations | Not affected |
Data returned to Notion AI by tools (tool-call results) | Not included in the exposed transcripts |
Text typed into Notion AI chats, and the AI's replies | May be exposed |
Chat labels showing who wrote it or which workspace | Not included ("unattributable") |
Passwords or API keys pasted into Notion AI | Treat as exposed. Rotate them. |
"Unattributable" means the chats carried no author or workspace label. It does not mean anonymous: a chat that names a person, company, or project can still point back to you.
What Notion has done
- Shut down its connections to Fireworks.
- Disabled the Insights feature while it investigates.
- Stopped serving open-weight models through Fireworks.
What to do now
- Review the exposed chats. Workspace owners can open the retrieval link in Notion's notice email and read what was in them.
- Rotate any credentials that anyone pasted into Notion AI: passwords, API keys, tokens.
- Look for public links. If a chat contains a link to a page published to the web, confirm that page should be public.
- Check obligations. If the chats contained customer, member, or sponsor personal information, check whether you have notification duties. Ask your attorney. This brief is not legal advice.
- Going forward, do not paste secrets or sensitive personal data into any AI chat.
Open questions
- The date range and number of exposed chats. Notion's notice does not say.
- Written confirmation from Notion that Fireworks never held any token or integration access into customer workspaces.
- Fireworks' public bulletin does not mention Notion or chat transcripts. The scope statement above comes from Notion and has not been independently confirmed.
Sources
- Notion security notice to workspace owners, November 9-10, 2026
- Fireworks AI incident update, November 9, 2026
- Fireworks AI original bulletin
- Notion AI settings overview (Insights)
Prepared by Modern Operators. Questions: reply to the email that brought you here.