The Fireworks AI breach exposed chat transcripts belonging to Notion AI customers who used the Insights feature, according to disclosures from both companies. Fireworks AI said an attacker breached its cloud provider and reached a development system, enabling access to some customer data. Notion said the incident affected fewer than 1 percent of its workspaces, while warning that unattributed conversations could still contain sensitive information.
What the Fireworks AI breach exposed
Fireworks AI said the cybercriminals took customer billing information and some datasets. The company serves tens of thousands of customers worldwide, including legal technology company Harvey and AI company Cursor. Notion is among the confirmed affected customers, although it has not said that every category of data taken from Fireworks was also exposed to Notion users.
Notion said Fireworks first alerted it to the incident on the evening of November 2, 2026, after attackers accessed a small dataset. Its initial review found only synthetic testing data. By the morning of November 3, Notion had disconnected its systems from Fireworks, deleted the data held in its systems and stopped all connectivity between the companies.
The assessment changed on November 6, when Fireworks warned that attackers might have accessed customer data. Fireworks confirmed a new dataset on November 8. Notion then identified Notion AI chat transcripts processed through Insights, a feature designed to help teams understand their AI usage.
Notion said the transcripts contain any input to or output from the model that was written into the chat. For the vast majority of affected workspaces, those conversations were unattributable. They were not labelled with the identity of the person who wrote them or the workspace from which they came. Beyond the text itself, Notion said there was no information connecting the chats to users, workspaces or companies.
Why unattributed chats still create risk
The absence of account labels does not make the exposed material harmless. Cybersecurity News noted that information typed into a chat could still identify a person or business. Customers may have pasted passwords, API keys or other credentials into Notion AI, and those secrets can remain sensitive even when the surrounding conversation cannot be linked to a particular workspace.
Notion revoked exposed Notion API keys found in affected user messages on November 11. The company also recommends that affected customers rotate passwords, API keys and other credentials pasted into Notion AI during the incident period. Notion said it contacted affected customers and provided instructions for reviewing the impacted data securely inside their workspaces.
Customers who have not received a notification have not been identified as affected and need no action at present, according to Notion. Its investigation remains open, and the company said it would contact additional customers if it found further exposure. Notion said its own systems were not breached and that no other Notion features were affected.
Insights disabled as review continues
Notion used Fireworks AI for two purposes. It hired the company on classification jobs supporting Insights, and it also used Fireworks as a general inference provider for open-weight models inside its product. Notion has disabled Insights while investigating the incident and stopped serving open-weight models through Fireworks.
Notion described Fireworks as one of the most used global AI infrastructure platforms, serving tens of thousands of customers and used by hundreds of thousands of developers. That scale matters because a compromise at the infrastructure layer can propagate into products operated by downstream customers. TechCrunch reported that the Fireworks AI breach illustrates how technology companies depend on other providers and how cyberattacks can consequently spill over into other customers.
Second Fireworks incident in as many months
The Fireworks AI breach is the second incident affecting the inference platform in as many months. Fireworks identified the earlier security incident on October 6, when an unauthorized third party accessed environment variables used in evaluation jobs in a limited number of customer accounts.
Fireworks said it believed environment variables, including API keys and tokens stored as secrets, were captured in certain affected accounts. At the time, the company said it had detected no evidence of unauthorized access to customer models, datasets, training data, inference traffic or personal information within its security perimeter or control. Its platform is zero data retention by default, meaning it does not store prompts or outputs by default.
Containment began on October 6, and Fireworks notified every identified affected customer. It revoked internal credentials involved in the incident, affected Fireworks API keys and keys identified as created by the actor. The company also added access restrictions and said it was reviewing how secrets were made available to evaluation jobs.
Financial motivation and remaining questions
Fireworks AI believes the hackers were financially motivated and focused on selling tokens created through unauthorized access to large language models. According to TechCrunch, those schemes sell model access to unauthorized third parties, allowing them to consume AI services without bearing the cost.
For Notion, the central lesson is that third-party inference access can put conversation content into the path of an attacker even when the document company itself remains secure. The Fireworks AI breach also leaves questions about the exposed conversation set, the identification of affected workspaces and the extent to which credentials entered chats could be reused. Notion has not claimed that the entire Fireworks breach was transferred to its users, but its confirmed exposure is significant because sensitive details may sit inside chats without visible account attribution.