Quick Answer
Notion says a Fireworks AI vendor incident exposed some Notion AI chat transcripts used by Insights and affected fewer than 1% of workspaces. Notion disconnected from Fireworks, disabled Insights, and says most affected transcripts lacked identity labels. Workspace owners should review Notion’s incident interface and rotate any passwords, API keys, or credentials pasted into Notion AI.
Key Takeaways
- Notion says fewer than 1% of its workspaces were affected by the Fireworks AI incident.
- The exposed dataset contained Notion AI chat transcripts used for the Insights feature.
- Notion says most affected transcripts did not include labels connecting them to a writer, workspace, or company.
- Notion disconnected from Fireworks on November 3 and later disabled Insights during its investigation.
- Notion advises affected users to rotate passwords, API keys, and other credentials pasted into Notion AI.
What happened in the Notion AI chat transcripts breach?
The Notion AI chat transcripts breach involved a security incident at Fireworks AI, a third-party vendor that had served open-weight models inside Notion AI. Fireworks said a third-party cloud provider hosting its research and development machines experienced an incident on October 23, 2026. Fireworks said an intruder then used that access on October 24 to reach development machines and run an unauthorized workload.
Notion initially understood the incident to involve only a small dataset containing synthetic test data. Fireworks provided that initial assessment on November 2, according to Notion’s security advisory. The incident became more serious for Notion customers after Fireworks said on November 6 that potential customer data may also have been accessed.
Notion says Fireworks confirmed the newly identified dataset on November 8. The dataset contained Notion AI chat transcripts used for Notion’s Insights feature, which analyzes information from AI conversations. The practical concern is not limited to a service outage. Users who pasted sensitive business details, credentials, or personal information into an affected AI conversation should treat that content as potentially exposed.
The breach also illustrates why third-party services matter in basic cybersecurity planning. A company can secure its own systems while still facing risk through a vendor that processes data or provides infrastructure on its behalf.
Which Notion AI data was potentially exposed?
The potentially exposed Notion data consisted of AI chat transcripts used by the Insights feature. Notion says the transcripts were, for the vast majority of affected workspaces, “unattributable.” In practical terms, Notion says those records lacked labels that connected them to a specific writer, workspace, or company.
Notion also says the vast majority of the affected transcripts did not contain tool-call results. That distinction matters because tool-call results can contain information returned from connected services or actions. The absence of those results reduces one category of potential exposure, but it does not make the chat text itself harmless if a user pasted confidential material into a prompt.
Notion has not said that every transcript in the dataset contained sensitive information. Notion users should therefore avoid assuming that a workspace was safe solely because the data was generally unattributable. A transcript can still contain a password, API key, internal project detail, customer information, or other material that identifies a person or organization through its contents.
AI chat content deserves the same care as other cloud-stored work material. A recent AI prompt exposure incident similarly shows why organizations should consider what employees enter into AI tools, not only which files they upload.
How many Notion workspaces did the Fireworks incident affect?
The Fireworks AI incident affected fewer than 1% of Notion workspaces, according to Notion’s November 9 update. Notion did not publish an exact workspace count in the advisory, so users should not infer a specific number from the percentage. The available figure describes the proportion of workspaces, not the number of individual users or the number of transcripts.
The limited scope is important context, but it does not remove the need for affected organizations to respond. A breach that reaches a small share of workspaces can still create meaningful risk for a team that stored credentials or sensitive discussions in AI chats. The appropriate response depends on the content entered into Notion AI, not simply on the overall percentage of workspaces affected.
| Known detail | What Notion disclosed | Why it matters |
|---|---|---|
| Affected scope | Fewer than 1% of Notion workspaces | The incident was limited in scope, but affected workspaces still need review. |
| Data type | Notion AI chat transcripts used by Insights | Prompt text can contain confidential information or credentials. |
| Identity labels | Most transcripts were unattributable | Most records lacked labels connecting them to a writer, workspace, or company. |
| Tool-call results | Most transcripts did not contain them | The disclosed dataset generally did not include results returned by connected tools. |
Notion workspace owners should focus on the incident review tools provided by Notion rather than attempting to estimate their exposure from the overall percentage. A review of actual potentially exposed content provides a more useful basis for credential rotation and internal notification decisions.
What actions did Notion take after learning about the vendor incident?
Notion disconnected its systems from Fireworks on November 3, deleted data held in Fireworks systems, and stopped communications between its own systems and the vendor. Notion took those actions after Fireworks initially described the accessed material as a small dataset containing only synthetic testing data. The response limited continued data exchange while Notion assessed the incident.
Notion later disabled Insights during its investigation. Notion also says it is no longer using Fireworks to serve open-weight models inside Notion AI. Those steps matter because they separate the affected vendor from Notion’s active AI service path while the company investigates the scope and nature of the exposed dataset.
Fireworks says its investigation concerns an incident involving a cloud provider that hosted its research and development machines. Fireworks’ incident update says the intruder reached development machines and ran an unauthorized workload after the October 24 access. That description explains the vendor-side path into the incident, although it does not change the need for Notion customers to review affected chat content.
Notion’s actions reduce ongoing reliance on Fireworks, but they cannot undo access that may have occurred before the systems were disconnected. The practical response remains to identify secrets or other sensitive information that users placed in Notion AI during the affected period.
What should affected Notion users do now?
Affected Notion users should treat any chat content shown in Notion’s incident review interface as exposed and rotate passwords, API keys, and other credentials pasted into Notion AI. Notion specifically recommends credential rotation because a secret copied into a chat transcript can remain usable if the related account or service does not invalidate it.
Start with active credentials that could provide access to systems, developer tools, cloud services, or customer data. Replace the old credential, update the application or service that relies on it, and revoke the prior credential where the relevant provider supports revocation. Document the change so that a team does not accidentally restore an old key in a script, integration, or shared configuration file.
- Open Notion’s security incident review interface if you are a workspace owner.
- Identify any passwords, API keys, tokens, or confidential details shown in potentially exposed content.
- Rotate each active credential through the service that issued it.
- Revoke the old credential when the service provides a revocation option.
- Notify the appropriate security or IT administrator if the content involved company systems, customer data, or shared accounts.
Stop and contact your organization’s security team or the affected service provider if you cannot determine whether a credential remains active. Users should not wait for evidence of misuse before rotating a password or key that appeared in potentially exposed content. Organizations that manage many employee accounts may also need a coordinated response, especially when chat content included shared access details.
How can Notion workspace owners review potentially exposed content?
Notion workspace owners can review potentially exposed content through Notion’s Security incident review interface. Notion has directed affected users toward that review process, and independent coverage says workspace owners can use the interface to examine the content connected to the incident. Incident coverage from BleepingComputer identified the workspace-owner review option after Notion published its updated disclosure.
Notion workspace owners should review the displayed content carefully rather than searching only for the word “password.” API keys, access tokens, connection strings, recovery codes, and internal URLs can create security concerns even when they do not look like a conventional password. Confidential project names, customer details, and internal discussions may also require an internal privacy or legal review.
The review process should be handled by someone authorized to assess the workspace’s content. A workspace owner can involve an IT administrator, security lead, or privacy officer when the conversation text includes company-sensitive information. The appropriate escalation point depends on the organization, but the decision should be based on the data found in the review interface rather than on assumptions about what employees may have entered.
Organizations that have experienced other vendor-related data incidents may already have a response process. The same practical discipline applies to incidents such as a newsletter vendor breach: identify the exposed data, assess its sensitivity, take corrective action, and communicate accurately with affected people.
Why does the Notion incident matter for AI privacy practices?
The Notion AI chat transcripts breach matters because AI prompts can contain data that users would not normally place in an ordinary support ticket or public form. Employees often use AI chat tools to summarize notes, draft messages, troubleshoot code, and analyze internal information. Each use can place sensitive material into a service operated through several technical providers.
Notion says the affected transcripts were used for Insights, and most lacked labels tying the data to a workspace or company. That limitation reduces the information available in most records, but unattributable data can still be sensitive. A chat transcript that contains a credential or a customer detail can create risk through the text itself, even without a separate account label.
The sensible long-term response is to create clear rules for AI chat use. Organizations can tell employees not to paste passwords, API keys, recovery codes, or other active secrets into prompts. Organizations can also define which kinds of internal, customer, and regulated information require approval before an employee uses an AI feature.
Notion’s vendor incident does not mean every AI feature is unsafe. The more accurate conclusion is that AI tools need the same vendor assessment, credential hygiene, and data-minimization practices used for other cloud services. Users should share only the information required for the task and remove active credentials before submitting a prompt.
What remains unknown about the Notion AI chat transcripts breach?
The Notion AI chat transcripts breach still has important unanswered questions. Notion has not published an exact number of affected workspaces, an exact number of transcripts, or a detailed list of the contents of every exposed record. Notion has disclosed that fewer than 1% of workspaces were affected and that the dataset contained Insights-related AI chat transcripts.
Notion also has not said that every affected transcript was anonymous or free of sensitive content. Instead, Notion says the vast majority of transcripts were unattributable and did not contain tool-call results. The wording matters because “vast majority” does not mean every record had the same characteristics.
Users should avoid drawing broader conclusions that the available evidence does not support. The disclosed facts show a vendor security incident, a dataset containing some Notion AI chat transcripts, and a limited workspace impact. The disclosed facts do not establish that every affected user suffered account compromise or that every transcript contained confidential data.
The practical response is proportionate caution. Review the available incident information, rotate secrets entered into Notion AI, and monitor official Notion updates for additional findings. Notion users who need help accessing the review interface should contact Notion support or their organization’s workspace administrator.
FAQ
Did the Notion breach expose every workspace?
No, Notion says the Fireworks AI incident affected fewer than 1% of Notion workspaces. Notion has not published an exact number of affected workspaces in its advisory.
What data did the Notion AI chat transcripts breach involve?
The Notion AI chat transcripts breach involved chat transcripts used by Notion’s Insights feature. Notion says most affected transcripts lacked labels tying them to a writer, workspace, or company and did not contain tool-call results.
Should Notion users change passwords after the Fireworks incident?
Yes, Notion advises affected users to rotate passwords, API keys, and other credentials pasted into Notion AI during the affected period. Users should also revoke old credentials where the issuing service provides that option.
Can Notion workspace owners review exposed content?
Yes, Notion workspace owners can review potentially exposed content through Notion’s Security incident review interface. Workspace owners should involve an IT or security administrator if the reviewed content includes active credentials or sensitive company information.
Is Notion still using Fireworks AI for Notion AI models?
No, Notion says it is no longer using Fireworks to serve open-weight models inside Notion AI. Notion also says it disconnected its systems from Fireworks and disabled Insights during the investigation.