Notion warned on 9 November 2026 that transcripts of conversations with its Notion AI assistant had been exposed in the hack of Fireworks AI, a provider that ran some of its models. Fewer than 1% of workspaces are affected, but the case highlights a blind spot: what users entrust to an AI assistant passes through subcontractors they never see. It also puts a contractual promise to the test: the promise to retain nothing.
Two intrusions in one month at Fireworks AI
Fireworks AI provides the infrastructure used to run and train open-weight models. According to BleepingComputer, the company had already reported in early October the theft of API keys and tokens stored as secrets for a limited number of customer accounts, activity it links to a criminal group reselling fraudulent access to language models.
A second incident followed. On 23 October, an unnamed third-party cloud provider hosting Fireworks’ research and development machines was compromised; on 24 October, the attacker used it to reach the company’s development workstations and launch an unauthorised workload there. According to the same outlet, the data accessed included resource metadata, billing information (addresses, invoice history, credit balance and usage) and, for some customers, partial copies of datasets and model weights. Bank card numbers are not affected, as Fireworks says it does not store them. The company is working with Palo Alto Networks’ Unit 42 team to assess the extent of the damage.
How Notion AI conversations ended up exposed
Notion was not hacked directly. It relied on Fireworks to serve the open models behind Notion AI and its Insights feature, which analyses how the assistant is used. BleepingComputer confirmed on 11 November that the exposed transcripts came specifically from Insights data. The security advisory published by Notion sets out the timeline: on 2 November, Fireworks reported access to a small batch of data, which Notion identified as synthetic test data; on the morning of the 3rd, Notion cut all connections with its provider and had its data deleted; on the 6th, Fireworks warned that customer data might have been affected; on the 8th, it confirmed this new batch.
The batch contained transcripts of chats with Notion AI used for Insights. Notion says that, for most of the affected workspaces, they are linked neither to an author nor to a workspace, and for the most part do not contain the output of the assistant’s actions (searches, page reads). Its help page nevertheless states that the full text of messages and of the assistant’s replies is included, and that those replies may reproduce excerpts from the pages consulted. IT-Connect considers this notion of “non-attributable” data questionable: a conversation frequently mentions a customer, a project or an email address. According to the same site, on 11 November Notion revoked Notion API keys found in messages, which in IT-Connect’s view proves that secrets were circulating in them. The Insights feature has been disabled and Notion no longer uses Fireworks for its open models.
The “zero retention” clause put to the test
This is the most sensitive point. In its help page on the incident, Notion explains that its no-retention commitment applies to requests sent to model providers to generate responses, but not to features that require conversations and responses to be stored, such as chat history or Insights. Above all, Notion had a contractual no-retention commitment from Fireworks, and yet finds that data was kept on the endpoints it used. Fireworks maintains, according to IT-Connect, that its services where this option is enabled by default were not affected.
For businesses, the lesson goes beyond Notion: a contractual clause is not technical proof. So-called analytics or service-improvement features are precisely the ones that retain data, and every subcontractor added to the chain widens the attack surface.
Steps to take if your workspace is affected
Notion says it is contacting affected customers directly; if you have not heard from it, no action is required for now. Owners of affected workspaces can download the exposed data from the help menu in the sidebar, under “Security incident review”. On Business and Enterprise plans with a verified domain, owners can also download annotated files that flag credentials and personal data. The company then recommends:
- reviewing this data with the security team and storing it in a restricted-access location;
- replacing immediately any password, API key or token it contains, starting with administrative and production access;
- being wary of phishing attempts that reuse names or addresses mentioned in the conversations;
- checking access logs for suspicious use of the exposed credentials;
- keeping secrets out of conversations and documents, using a secrets manager instead.
More broadly, the incident is a prompt to ask every vendor for the list of its AI subcontractors, the actual retention period for conversations and whether the features that store them can be disabled.
Frequently asked questions
How can I tell whether my Notion workspace is affected by the Fireworks breach?
Notion says it is notifying the owners of affected workspaces directly; they account for fewer than 1% of the total. If neither you nor your workspace owner has been contacted, your workspace has not been identified as affected at this stage.
What data was exposed?
Transcripts of conversations with Notion AI used for the Insights feature, in most cases without the author’s or workspace’s name. They may nevertheless contain whatever users typed into them: customer names, addresses, even passwords or keys pasted into the assistant.
Should I stop using Notion AI?
Notion states that no other feature was affected and that it has stopped using Fireworks. The key habit is above all never to enter a secret into any AI assistant, whichever it is, and to treat these conversations as potentially sensitive data.
Sources
- Notion AI : le piratage de Fireworks AI a exposé des conversations de clients — IT-Connect, 2026-11-12
- Fireworks AI discloses new breach after cloud provider hack — BleepingComputer, 2026-11-10
- Security incident involving a third-party AI vendor — Notion (security advisory), 2026-11-09
- Notice about the Fireworks AI incident that may impact some Notion workspaces — Notion (help centre), 2026-11
- Notion says Fireworks breach exposed customer AI chat transcripts — BleepingComputer, 2026-11-11