Fireworks AI breach exposed some Notion AI chat transcripts

On 9 November 2026, Notion and Fireworks AI both updated their notices about a security incident at Fireworks, an AI infrastructure company that Notion used as a vendor. Notion says that on 6 November Fireworks told it about an incident affecting fewer than 1% of Notion workspaces, and that the exposed data included Notion AI chat transcripts. Fireworks says the attackers were a financially motivated cybercriminal group, and that they took account and billing information and, for some accounts, secrets, datasets and incomplete model weights. Notion says its own systems were not breached.

What happened at Fireworks

Fireworks first published a bulletin on 9 October 2026. At that point, it only knew that secrets stored on Fireworks (for example, ones used in evaluation jobs) had been accessed. It brought in Palo Alto Networks Unit 42 for forensics and notified law enforcement. Fireworks says the evidence links the attack to a group that sells stolen access to large language models, a practice known as "LLMJacking".

Fireworks also describes a second incident. On 23 October, a third-party cloud provider that hosted Fireworks research and development machines had its own security incident. On 24 October, the attacker used that access to reach Fireworks development machines and run an unauthorised workload, which affected more customer data. Fireworks says it detected this the same day, and that it had seen no further successful access to its customer platform as of 25 October.

Fireworks says the affected internal application gave access to:

• Resource metadata, such as resource identifiers, display names, descriptions and creation times.
• Billing information, such as billing and shipping addresses, invoice and payment history, account balance and credit usage. Fireworks does not store payment card numbers, and it says they were not affected.
• For certain customers, a subset of incomplete model weights and datasets.

Fireworks says it has seen no impact to its Inference, Training SDK and Nexus services, which keep no customer data by default. Its investigation is ongoing.

What it means for Notion users

Notion used Fireworks to classify chats for its Insights feature, which shows customers how they use Notion AI. It also used Fireworks to serve open-weight models inside Notion.

Notion gives this timeline:

• 2 November: Fireworks told Notion that a small set of data had been accessed. Notion says this turned out to be synthetic test data, with no customer data in it.
• 3 November: By the morning, Notion had disconnected its systems from Fireworks, deleted all of its data held there, and stopped all communication with Fireworks.
• 6 November: Fireworks told Notion that attackers may also have accessed potential customer data.
• 8 November: Fireworks confirmed that second dataset.

Notion says the second dataset included Notion AI chat transcripts used for Insights. For most affected workspaces, the transcripts were unattributable: they were not labelled with who wrote them or which workspace they came from, and they did not include tool call results. Notion says nothing beyond the text of the chats links them to a workspace, user or company. It says no other Notion features were affected.

The Record, a news site from Recorded Future, reported that Fireworks has more than 10,000 customers. Fireworks has not said how many of its customers were affected. It says only a limited set of accounts lost secrets, datasets or model data.

The remedy

There is no software update to install. Both companies say they have notified affected customers, and both investigations are still open.

Notion has turned off Insights while it investigates and no longer serves open-weight models through Fireworks. Fireworks says it has revoked and replaced credentials and service accounts, isolated affected systems, tightened access to stored data and improved logging. It has also turned off self-serve dataset uploads and downloads for Batch Inference and dataset-based training for now.

If you use Notion:

• If Notion has not contacted you, it says it has not identified your workspace as affected, and no action is needed right now. It says it will contact you directly if that changes.
• If Notion has contacted you, follow the emailed instructions to review the affected transcripts inside your workspace, and treat that data as exposed.
• If anyone in an affected workspace pasted passwords, API keys or other credentials into Notion AI during the incident, rotate them.

If you use Fireworks:

• Read any incident notice from Fireworks and follow its recommended steps.
• If your account used stored secrets, such as keys used in evaluation jobs, rotate them, even if Fireworks has not told you they were affected.
• Questions can go to security-notice@fireworks.ai or in a reply to your notification email.

Sources

• Notion: Fireworks AI incident
• Fireworks AI: Update on October 2026 security incident
• The Record: AI company Fireworks says hackers stole data, billing info during October breaches