A cyberattack on artificial intelligence infrastructure provider Fireworks AI has exposed chat transcripts belonging to some Notion AI customers, highlighting the security risks associated with companies relying on third-party AI vendors. The attackers accessed Fireworks’ development environment through a compromised third-party cloud provider, gaining access to customer information and datasets. Notion subsequently confirmed that some of the stolen data included conversations generated through its AI-powered workspace platform.
The incident affects fewer than 1% of Notion workspaces, according to the company’s security advisory. The exposed information includes inputs submitted by users to Notion AI and the models’ responses through the platform’s Insights feature. Notion says most affected transcripts could not be linked to individual users or workspaces, but it has advised impacted customers to treat the information as exposed and rotate any credentials included in their conversations.
How Hackers Breached Fireworks AI
The security incident originated at a third-party cloud provider hosting Fireworks AI’s research and development infrastructure.
According to Fireworks’ investigation, the cloud provider experienced a security incident on October 23, 2026. On October 24, an attacker used the compromised environment to gain access to Fireworks development machines and execute an unauthorised workload.
The intrusion allowed attackers to reach parts of Fireworks’ internal development infrastructure and access certain customer-related information.
Fireworks confirmed that the compromised information included billing data, resource metadata, and a subset of customer datasets and incomplete model weights. The company also reported that secrets associated with a limited number of customer accounts were affected.
The company believes the attackers were financially motivated and sought unauthorised access to large language models. Such activity is associated with a practice known as LLMjacking, in which attackers steal or misuse AI credentials and resell access to computing resources or models.
Fireworks said it contained the incident and brought in external cybersecurity specialists to assist with the investigation.
How Notion AI Chat Transcripts Were Exposed
Notion was among the customers affected by the Fireworks breach.
The productivity platform used Fireworks AI for two purposes: classification tasks supporting its Insights feature and inference services for open-weight AI models available through Notion AI.
Insights helps workspace administrators understand how their teams use artificial intelligence. The feature relies on analysing information from AI interactions, making chat-related data part of the processing workflow.
Notion initially received an alert from Fireworks on November 2 about unauthorised access to a dataset. Its first investigation indicated that the dataset contained synthetic testing information rather than real customer conversations.
As a precaution, Notion disconnected its systems from Fireworks on November 3, deleted its data stored with the provider and stopped further communication between the two systems.
However, Fireworks subsequently notified Notion on November 6 that customer data might also have been accessed. On November 8, it confirmed that the affected dataset included real customer information.
Notion’s investigation identified chat transcripts associated with the Insights feature.
The transcripts included information users entered into Notion AI and the responses generated by the AI models.
What Information Was Compromised?
Notion says the exposed transcripts contained the text written in the relevant AI conversations, including user prompts and model responses.
However, the company said most of the affected transcripts were unattributable. This means they did not contain labels identifying the person who wrote the messages or the workspace from which the conversations originated.
The transcripts also did not include tool-call results, and Notion said there was no additional information connecting most of the exposed conversations to specific users, workspaces or companies.
| Information category | Status |
|---|---|
| Notion AI chat inputs | Exposed in the affected dataset |
| AI-generated responses | Included in the exposed transcripts |
| User and workspace identification | Missing from most affected transcripts |
| AI tool-call results | Not included |
| Notion AI Meeting Notes | Not affected as a separate feature |
| Other Notion features | Not reported as affected |
| Passwords and API keys | Could be exposed if users pasted them into affected chats |
The absence of identifying information reduces the ability to associate most transcripts with particular customers. However, it does not guarantee that the content is harmless.
For example, a user might have entered internal business information, customer details, unpublished product plans or credentials into an AI conversation. Such information could remain sensitive even without a name or workspace identifier attached.
Fewer Than 1% of Notion Workspaces Affected
Notion has said the incident affects fewer than 1% of its workspaces.
The company has contacted customers it identified as affected and provided instructions for reviewing the compromised information securely.
Workspace owners can access an incident review section within Notion and examine the relevant data. They can also share instructions with workspace members so individuals can review their own affected conversations.
Notion says customers who have not received a notification do not need to take action at this stage. The company will contact additional customers if its continuing investigation identifies further affected workspaces.
The company has not publicly disclosed the exact number of affected workspaces or the total volume of chat transcripts accessed by the attackers.
Notion Disables Insights and Stops Using Fireworks AI
Following confirmation of the incident, Notion took steps to prevent further exposure through the affected provider.
The company disconnected its systems from Fireworks, deleted its stored data there and stopped using the provider for the relevant AI services.
It also disabled the Insights feature while the investigation continues. Notion is no longer serving open-weight models through Fireworks.
In a November 11 update, Notion said it had revoked exposed Notion API keys discovered in affected user messages during its investigation. On November 12, it also reported exposed third-party API keys found in affected messages to the vendors that issued them.
These measures are intended to reduce the risk of compromised credentials being used to access other services.
Notion has also recommended that affected customers rotate passwords, API keys and other credentials that may have been included in their conversations.
Fireworks AI Faced Another Security Incident in October
The November disclosure is not the first security incident involving Fireworks AI in recent weeks.
The company previously reported an incident detected on October 6 involving unauthorised access to internal credentials stored as secrets in evaluation jobs.
The later attack, which involved the compromised third-party cloud provider, expanded the scope of the company’s investigation and revealed additional exposure involving customer datasets and other information.
Fireworks has said it is working with cybersecurity specialists to investigate the incidents and strengthen its security controls.
The company serves developers and businesses that use its infrastructure to access, deploy and fine-tune open AI models. Its customer base includes companies operating in areas such as AI development and legal technology.
The incidents raise questions about how AI infrastructure providers protect customer information, particularly when their services are integrated into other companies’ products.
The Bigger Picture
The Fireworks AI breach demonstrates how a cybersecurity incident at one technology provider can affect customers of another company, even when the customer-facing platform itself has not been compromised. Notion users interacted with an AI feature inside a familiar productivity application, but some of the information involved in those conversations was processed by an external infrastructure provider.
This creates a complicated security environment for businesses adopting AI tools. Companies must evaluate not only the security of their own applications but also the data-retention practices, access controls and incident-response procedures of the vendors operating behind those products. The incident also illustrates why organisations should be cautious about entering passwords, API keys and confidential business information into AI conversations.
Looking Ahead
Fireworks AI and Notion are continuing their investigations, while Notion has disabled the affected Insights feature and stopped using Fireworks for its open-weight model services. The company says it will directly notify customers if additional affected workspaces are identified. For customers who have already received notifications, reviewing the exposed transcripts and rotating any compromised credentials are the immediate priorities.
The incident is likely to increase scrutiny of third-party AI infrastructure providers and the way they handle customer prompts and generated responses. As more businesses integrate external AI models into everyday applications, security agreements and data-retention commitments will become increasingly important. The challenge for the industry will be ensuring that sensitive information remains protected throughout the entire AI supply chain, not just within the application that customers use.
SEO Metadata
SEO Title: Fireworks AI Cyberattack Exposes Notion Customers’ AI Chat Transcripts
Meta Description: A cyberattack on Fireworks AI exposed Notion AI chat transcripts from fewer than 1% of workspaces. Here’s what data was accessed and what affected users should do.
URL Slug: fireworks-ai-cyberattack-notion-customer-chat-transcripts
Focus Keyphrase: Fireworks AI cyberattack
Secondary Keywords: Notion data breach, Notion AI chat transcripts, Fireworks AI security incident, AI data breach, Notion customer data exposed, AI infrastructure cybersecurity
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
