If you use Notion AI at work, check your inbox today. Notion has confirmed that Notion AI chat transcripts from fewer than 1% of workspaces were exposed through a security incident at one of its AI vendors, Fireworks AI.
Notion’s own systems were not breached. The leak came from data Notion sent to Fireworks, which was kept there even though Fireworks had promised zero data retention.
This guide explains what happened, day by day, what data was involved, how to check if your workspace is affected, and exactly what to do if it is.
- What leaked: Notion AI chat transcripts (your prompts and the AI’s replies) that Notion sent to Fireworks AI for its Insights feature.
- Who is affected: fewer than 1% of Notion workspaces, per Notion. Affected customers have been contacted.
- Not affected: Notion’s own systems, AI Meeting Notes audio, transcripts and summaries (unless pasted into a Notion AI chat), and other Notion features.
- How to check: workspace owners open the sidebar ? menu > Security incident review on desktop. No email and no review option means Notion has not found your workspace affected.
- Do now: rotate any password, API key or token that anyone pasted into Notion AI chats, and treat the listed data as exposed.
- Notion’s fix: cut off Fireworks on 3 November, paused Insights, stopped Fireworks-served open-weight models and halted training runs.
What Happened, in Plain Words
Notion uses outside AI companies to run some of its AI features. One of them was Fireworks AI, a cloud platform that hosts and serves AI models for other businesses.
Attackers got into parts of Fireworks’ systems in October. Among the data they reached was a set of Notion AI chat transcripts that Notion had sent to Fireworks so it could sort and classify them for a usage feature called Insights.
Notion says it confirmed the customer data link on 8 November 2026, published a security notice, and contacted affected customers. It describes the impact as “fewer than 1% of Notion workspaces”.
Note: Notion stresses that this is not a breach of Notion itself. Your pages, databases and files stored in Notion were not part of this incident, based on Notion’s notice.
Timeline: Fireworks to Notion
The dates below come from Notion’s security notice, Fireworks’ bulletins and coverage by Cyber Security News and SmartScope. Fireworks’ own incident started weeks before Notion knew its customers were involved.
| Date (2026) | What happened | Source |
|---|---|---|
| 6 Oct | Fireworks detects misuse of internal credentials. An intruder reached environment variables used by evaluation jobs in a limited number of customer accounts. | Fireworks bulletin |
| 7 Oct | Fireworks starts notifying customers and later revokes keys, employee credentials and service tokens. | Cyber Security News |
| 23-24 Oct | A cloud provider hosting Fireworks’ research machines has its own incident. An unauthorised party uses it to run a workload on Fireworks dev machines on 24 Oct. Fireworks says it fixed this the same day. | Fireworks update, via Cyber Security News |
| 2 Nov (evening) | Fireworks tells Notion attackers accessed a small dataset. Notion’s first check finds only synthetic test data. | Notion notice |
| 3 Nov (morning) | Notion disconnects from Fireworks, deletes all its data there and stops sending traffic. All training runs are halted. | Notion notice |
| 6 Nov | Fireworks warns that customer data may also have been accessed. Notion reopens its investigation. | Notion notice |
| 8 Nov | Fireworks confirms the new dataset. Notion finds it contains Notion AI chat transcripts processed for Insights. | Notion notice |
| 9 Nov | Fireworks publishes an update on the wider breach, including account, billing and some model data. | Fireworks update |
| 10 Nov | Notion’s notice and customer emails are widely reported. | Press coverage |
What Data Was and Wasn’t Exposed
The key point: what leaked was chat text, exactly as it was typed into or written by Notion AI chat. Anything a person pasted into a chat is in scope, including secrets.
| Data type | Status | Detail |
|---|---|---|
| Notion AI chat transcripts | Exposed (affected workspaces) | Inputs and outputs written to the chat, as stored for Insights |
| Author or workspace labels | Mostly not included | Notion calls most affected transcripts “unattributable”: no author, no workspace label, no tool call results |
| AI Meeting Notes (audio, transcripts, summaries) | Not affected | Unless that text was pasted into a Notion AI chat |
| Pages, databases, files in Notion | Not affected | Notion says its own systems were not breached |
| LEAP programme data | Used on Fireworks | Volunteered data for training experiments; Notion halted all training runs |
| Metadata in Notion’s review CSV | Not exposed | Notion adds IDs and dates to help you review; it says these were not part of the leak |
Warning: “Unattributable” does not mean harmless. A chat that says “rewrite our Q4 plan for Acme Corp” or contains an API key still gives away who you are and what you hold.
Why Notion Used Fireworks AI
Notion’s notice lists three jobs Fireworks did for it. Knowing them explains why chat text was sitting on a vendor’s servers at all.
- Insights classification: Notion sent stored Notion AI requests and responses to Fireworks to classify use cases for the Insights dashboard. Insights is now paused and disabled.
- Open-weight model inference: Fireworks served some open-weight models for Notion. That has stopped.
- LEAP experiments: data volunteered through Notion’s Learning and Early Access Program was used to try training task-specific models.
Insights is the admin feature that shows how a team uses Notion AI. On the Notion AI settings page, it now reads as temporarily paused, and use cases and conversation counts are unavailable.
How to Check If Your Workspace Is Affected
If you are a workspace owner and did get the email, Notion has built a review tool inside the workspace. Use a desktop browser on the latest version; the data is not shown on mobile.
- Open the review page. In the left sidebar, click the ? (help) icon, then choose Security incident review.
- Download the member list. Click Download affected members. The CSV lists names, emails, membership status, user IDs and how many affected rows each person has.
- Share self-review links. Use Copy link to send members a link where they can see only their own affected chats.
- Get the content files (verified domains). If your workspace has a verified domain, download
affected_content.csvandaffected_content_annotated.csv. - Use the annotated file to triage. It adds record, workspace, user and thread IDs, dates, and an
__analysiscolumn that flags possible sensitive information. - Treat it all as exposed. Notion’s own wording: “treat this data as if it were exposed”.
Tip: Sort the annotated CSV by the __analysis column first. Start with rows flagged for credentials or personal data, because those need action today.
What to Do Now: Credential Rotation Checklist
Notion’s main instruction is simple: if anyone pasted passwords, API keys or other credentials into Notion AI during the affected period, rotate them right away. Here is how to turn that into a checklist your team can actually finish.
1. Search the exported chats for secrets
- Cloud keys: search for strings like
AKIA(AWS),AIza(Google),sk-(many AI APIs),ghp_orgithub_pat_(GitHub),xoxb-(Slack bots). - Words: “password”, “passwd”, “token”, “secret”, “Bearer”, “private key”, “connection string”.
- Personal data: customer emails, phone numbers, ID or bank numbers pasted for “clean up this list” style prompts.
2. Rotate, don’t just delete
- Issue a new key at the provider and revoke the old one. Deleting the chat does not make a leaked key stop working.
- Change passwords on any account mentioned, and turn on two-factor sign-in where it is missing.
- Database strings: change the user’s password or create a new user, then update your apps.
3. Check for misuse
- Review access logs and billing for each rotated service since early October.
- Look for unknown users, new API keys, unexpected AI usage spikes or new cloud resources.
4. Handle personal data properly
If chats held customers’ personal data, loop in your privacy or legal lead. Depending on where you operate, a vendor leak of personal data can trigger your own notice duties. That is a call for your counsel, not a chatbot.
For a similar checklist from the developer side, see our guide on the Claude Code “Don’t Ask Again” secrets leak, which walks through scanning repos and rotating keys.
If You Are a Member, Not the Owner
Only workspace owners can see the CSV files. Members and other roles can only see their own affected chats, through a link the owner shares.
- Ask your owner whether your workspace got Notion’s email.
- Open the review link they send, on a desktop browser.
- Rotate anything you pasted into Notion AI chats, even if you are not sure it was in the affected set.
- Personal Notion accounts: if you own your own workspace, you are the owner. The same sidebar steps apply.
The Zero Data Retention Catch
This is the part that should worry every company buying AI tools. Notion says its investigation found that data was retained at the Fireworks endpoints it used, despite a contractual zero data retention commitment from Fireworks.
Notion also clarified what its own ZDR promise covers. For Enterprise customers, ZDR applies to API requests sent to third-party model vendors to generate Notion AI answers.
It does not cover features that need to store requests and responses, such as chat history and Insights. In other words, your chats were stored on purpose for those features, then sent to a vendor for classification.
| Question | What Notion says |
|---|---|
| Does Enterprise ZDR cover AI answer generation? | Yes, for requests to third-party model vendors |
| Does it cover chat history? | No, chat history needs storage |
| Does it cover Insights? | No, Insights needed stored requests and responses |
| Did Fireworks keep data despite ZDR? | Yes, Notion’s investigation found data was retained |
| What is Notion doing about vendors? | Auditing critical vendors (inference providers, data processors) for data minimisation and ZDR |
The Wider Fireworks AI Breach
Notion is one customer of Fireworks. Fireworks’ 9 November update, as reported by Cyber Security News and SmartScope, describes a broader set of affected data.
| Fireworks data | Affected? |
|---|---|
| Account data (resource IDs, names, descriptions, creation times) | Yes |
| Billing data (addresses, invoices, payment history, balances, credit use) | Yes |
| Payment card numbers | No, Fireworks says it does not store them |
| Secrets, datasets and incomplete model weights | Yes, for a limited number of customers |
| Inference, Training SDK, Nexus | No detected impact, per Fireworks (zero retention by default) |
Fireworks says the evidence points to a financially motivated group that sells illicit access to AI models through routing gateways, a scheme known as LLMjacking. It notified law enforcement and brought in Palo Alto Networks Unit 42 for forensics.
Fireworks also paused self-service dataset uploads and downloads for Batch Inference and dataset-based training during the investigation. If you are a direct Fireworks customer, its advice is to replace revoked keys, rotate third-party secrets with their issuers, and review users, keys, jobs and datasets.
Other Recent AI Vendor Incidents
Notion’s case fits a pattern from the past few weeks: the weak spot is often a vendor, a setting or a helper tool, not the main AI model.
| Incident | What was exposed | Root cause | Our coverage |
|---|---|---|---|
| Notion AI via Fireworks (Nov 2026) | AI chat transcripts, under 1% of workspaces | Vendor breach plus data kept despite ZDR | This article |
| Anthropic business systems (Oct-Nov 2026) | Business contact and account details, not chats | Flaws in third-party business software | Anthropic incident guide |
| Claude Code “Don’t Ask Again” (Nov 2026) | 2,539 secrets in committed settings files (Apiiro) | Saved permission rules stored full commands | Secrets leak fix |
| Grok Build apps (Nov 2026) | Researchers at Claroc report about 650-800 public apps holding private data | Apps built and left publicly reachable | Reported by TeslaNorth |
Safer Habits for Any Workplace AI Tool
You can’t control a vendor’s vendor. You can control what goes into the chat box in the first place.
- Never paste live secrets. Replace keys with placeholders like
YOUR_API_KEYbefore asking AI to debug code. - Mask personal data. Swap real names and emails for fake ones when asking AI to format lists.
- Use temporary or no-history modes for sensitive one-off questions where the tool offers them. Our ChatGPT memory and Temporary Chat guide shows how that works in ChatGPT.
- Ask vendors one specific question: “Which features store our prompts, and which sub-processors see them?” ZDR answers often cover only part of the product.
- Keep a key inventory so you can rotate fast when the next notice lands.
Tip: Admins can keep a short “AI paste policy” in the team wiki: no credentials, no customer IDs, no unreleased financials. It costs nothing and would have made this incident a non-event for most teams.
What Is Still Unknown
- Exact window: Notion refers to “this timeframe” but has not published a start date for the affected period.
- Exact count: no number of workspaces or chats beyond “fewer than 1%”.
- Which Fireworks event: Fireworks’ bulletins do not name Notion, so it is not public which intrusion reached the Notion dataset.
- Insights return: Notion has paused Insights but not said when, or with which vendor, it will come back.
- Misuse: no public report so far of the Notion chat data being sold or published.
My Take
Notion handled the response well: it cut the vendor off within hours of the first alert, reopened the case when the facts changed, and built an owner review tool with downloadable files. That is better than most breach notices, which leave you guessing.
The bigger lesson is the ZDR gap. “Zero data retention” sounded like a blanket promise, but it only covered answer generation. Features like Insights quietly needed stored chats, and those chats then travelled to a sub-processor that kept them.
If your team uses any AI workspace tool, Notion or not, this week is a good time to ask vendors for a feature-by-feature data map. And if someone pasted a key into a chat, rotate it now; that one step removes most of the real risk here.
FAQ
Was Notion hacked?
No. Notion says its own systems were not breached. The exposure happened at Fireworks AI, a third-party AI vendor Notion used for Insights and some model serving.
How do I know if my Notion workspace is affected?
Notion has emailed affected customers. If neither you nor your workspace owner heard from Notion, it has not identified your workspace as affected, and it will contact you if that changes.
Where is the Security incident review in Notion?
On desktop, click the ? icon in the sidebar and choose Security incident review. Only owners of affected workspaces see the full files; it is not available on mobile.
Were my Notion pages or databases leaked?
Notion says no. The exposed data was Notion AI chat transcripts sent to Fireworks for Insights, not your stored pages, databases or files.
Were AI Meeting Notes recordings exposed?
No. Notion says meeting audio, transcripts and summaries were not affected, unless someone pasted that text into a Notion AI chat.
I pasted an API key into Notion AI. What should I do?
Create a new key at the provider and revoke the old one now, then check that service’s logs and billing for misuse since early October. Deleting the chat does not disable the key.
Is it safe to keep using Notion AI?
Notion has stopped using Fireworks, paused Insights and started a vendor audit. It is reasonable to keep using it, as long as your team avoids pasting secrets or sensitive personal data into any AI chat.
Does Notion’s zero data retention protect Enterprise chats?
Only partly. Notion says Enterprise ZDR covers requests sent to model vendors to generate answers, but not features that store chats, such as chat history and Insights.
Sources
- Notion Help: Security incident involving a third-party AI vendor
- Notion Security advisory
- Notion Help: Notion AI settings overview (Insights paused)
- Fireworks AI security bulletins
- Cyber Security News: Notion confirms AI chat transcripts exposed
- Cyber Security News: Fireworks AI data breach
- SmartScope: Notion AI and Fireworks AI incident explained
- TeslaNorth: Grok Build apps and private data (Claroc)
