Notion AI chats from under 1% of workspaces were exposed in a vendor breach. Rotate anything you pasted

Notion says attackers who breached its AI infrastructure vendor Fireworks AI accessed Notion AI chat transcripts stored for the Insights admin feature. Fewer than 1% of workspaces are affected and owners were emailed on November 9. Notion has cut off Fireworks and disabled Insights. If your workspace was notified, rotate any password or API key typed into Notion AI.

If you own or belong to a Notion workspace that received a security notice on or after November 9, treat everything typed into Notion AI as exposed. Rotate any password, API key or other credential that appears in those chats. If neither you nor your workspace owner got a notice, Notion says no action is needed right now.

What happened

Notion disclosed that attackers who broke into Fireworks AI, a company that ran some AI workloads for Notion, accessed a dataset of Notion AI chat transcripts. The details are in Notion’s security advisory, first published November 9 and revised November 10. BleepingComputer reported on it on November 11.

According to the advisory:

• Fewer than 1% of Notion workspaces are affected. Notion contacted those customers on November 9.
• The data is chat transcripts. They are the stored Notion AI chats that Notion sent to Fireworks to power Insights, an admin feature that shows how a team uses AI.
• Most of it is unlabeled. For “the vast majority” of affected workspaces, Notion says the transcripts carried no user or workspace label and no tool call results. The text of the chat itself is what could identify someone.
• Notion’s own systems were not breached. The access happened at Fireworks.

Notion’s timeline: Fireworks first warned it on November 2 about a dataset that turned out to hold only synthetic test data. By the morning of November 3 Notion had disconnected from Fireworks, deleted its data there and stopped sending traffic. On November 6 Fireworks said customer data may have been accessed, and on November 8 it confirmed the final dataset.

BleepingComputer reports that Fireworks traced the intrusion to an attacker who reached its development environment through a third-party cloud provider on October 23, and that Fireworks had a separate breach in early October. Those details come from BleepingComputer’s reporting on Fireworks, and Notion’s advisory does not repeat them.

What Notion turned off

• Insights is disabled while the investigation runs.
• Open-weight models are no longer served through Fireworks. Notion used the vendor as an inference provider for those models as well.
• Training runs are halted. Notion’s help page on the incident says it had used data volunteered through its early access program to experiment with training task-specific models on Fireworks.

Notion says AI Meeting Notes audio, transcripts and summaries were not affected unless someone pasted them into a Notion AI chat.

What to do

Workspace owners who were notified:

1. Open Notion in a desktop browser on the latest version. The review tool does not work on mobile.
2. In the sidebar, click ? and then Security incident review.
3. Use Download affected members for a CSV of the people whose chats are in the set.
4. If your workspace has a verified domain, download affected_content.csv to read the exposed transcripts. The annotated version flags possible credentials in each conversation.
5. Use Copy link to give each member access to their own affected chats.
6. Rotate every credential that shows up. Notion’s own advice is to treat the data as exposed.

Members of an affected workspace: ask the owner for the review link, read your own transcripts and change any password or key you pasted. Think about what else was in those chats: customer names, contract terms, salary numbers. Tell the people who need to know.

Everyone else: nothing to do today. Notion says its investigation is ongoing and it will contact any workspace it later finds was affected.

Zero data retention did not cover the feature that leaked

The detail that should change how teams use AI tools is in Notion’s help page. Enterprise customers buy Notion with a zero data retention commitment, meaning model vendors do not keep the prompts and answers. Notion says that promise applies to the live requests that generate an AI answer. It does not cover features where Notion itself must store chats, such as chat history and Insights.

For Insights, Notion sent those stored chats to Fireworks for analysis. Notion says Fireworks had contractually committed to zero data retention too, and that “during our investigation we learned that data was retained” from the endpoints it used. So the data sat at a vendor that had promised not to keep it. Notion says it will now audit its inference providers and data processors.

Our read: a retention promise on the main chat path says little about the analytics, admin and training features built around it. Each of those can copy your prompts to another company. Fireworks was already on the list of AI developer platforms hit in October that we cited in our Nvidia Brev and Trigger.dev story, alongside Northflank and Railway. Notion’s case shows the next step: a breach at a platform most users have never heard of reaching the chats they typed into a tool they use every day.

Two habits limit the damage. Keep credentials out of AI chats entirely, and use a secrets manager when an assistant needs access to something. Then ask each AI tool you pay for which sub-processors receive stored conversations, and for which features. Notion’s answer changed this week.