Notion Says AI Chat Transcripts Exposed in Third-Party Vendor Fireworks AI Breach
Notion has disclosed that chat transcripts from its AI features may have been exposed after a security incident at Fireworks AI, a third-party AI infrastructure vendor it used for parts of Notion AI. Notion says the breach affected fewer than 1% of its workspaces, according to its own security advisory.
What Notion used Fireworks AI for
Notion’s advisory says it relied on Fireworks for two things: running classification jobs for its Insights feature, which shows workspace admins how members use AI inside Notion, and for general inference on open-weight AI models. Fireworks notified Notion of the security incident, and Notion says Fireworks had retained data from the endpoints Notion used, despite a contractual commitment to zero data retention.
The exposed material consists of chat transcripts, meaning any text a user typed into or received from a Notion AI chat that was routed through Fireworks. Notion says the transcripts generally carried no metadata linking them to a specific workspace, user, or company. Notion AI Meeting Notes data was affected only if it had separately been used as input to a Notion AI chat.
What happened at Fireworks AI
Fireworks, a San Mateo-based AI infrastructure company with more than 10,000 customers, disclosed two separate breaches in October, according to The Record. It discovered the first on October 6 and hired Palo Alto Networks’ Unit 42 to investigate, which concluded a financially motivated cybercriminal group was behind it.
In a second incident on October 23, attackers compromised a third-party cloud provider that hosted Fireworks’ research and development machines. The next day, the same unauthorized party used that access to reach Fireworks’ development machines and run an unauthorized workload, which Fireworks says caused additional customer data impact. The company says the stolen data included account and billing information, credentials, invoices, payment history, and AI-related datasets, and that it has notified a limited number of affected customer accounts.
How many workspaces were affected, and Notion’s response
Notion says fewer than 1% of its workspaces were affected and that it has already contacted every customer it has identified as impacted. Workspaces that have not heard from Notion directly have not been flagged as affected, though the company’s investigation is still ongoing.
As of November 3, Notion disconnected entirely from Fireworks, deleted all of its data held in Fireworks’s systems, stopped sending any further traffic to the vendor, and halted training runs that had used Fireworks, including experimental work on task-specific models built with data from customers in its Learning and Early Access Program. Notion has also disabled the Insights feature while the investigation continues and says it is now auditing other critical vendors, including inference providers and data processors, for compliance with zero data retention and data minimization commitments.
What affected users should do
Notion’s advisory tells workspace owners to check a “Security incident review” panel, reachable from the sidebar’s help menu, to see whether their workspace was affected and to download a list of impacted members. Owners on workspaces with a verified domain can also download the affected content as CSV files. Individual members can review only their own affected content in the same place.
Notion is advising everyone, affected or not, to treat any data sent through Notion AI as potentially exposed. Anyone who pasted passwords, API keys, or other credentials into a Notion AI chat during the affected period should rotate them immediately. Workspace owners can revoke members’ access to their own affected content, though Notion notes this does not delete any data or change chat history retention.
What to watch next
Notion has not disclosed when the exposure window began, only that it cut ties with Fireworks on November 3. Whether other companies that used Fireworks for AI inference make similar disclosures, and whether Fireworks issues its own public accounting of what was exposed and for how long, remains to be seen.
Leave a Reply