A security incident at AI infrastructure provider Fireworks AI has spilled over into one of its most prominent customers, exposing chat transcripts generated by Notion AI. The breach, confirmed by both companies, affected fewer than 1% of Notion workspaces and highlights how deeply AI services depend on third-party infrastructure — and how quickly a single compromised vendor can expose data across the stack.
- What happened: Attackers breached a cloud provider hosting Fireworks development machines, then reached Fireworks systems and accessed customer billing data and some datasets.
- Who was affected: Notion confirmed that transcripts from its Insights feature were stolen, covering less than 1% of workspaces; most transcripts were unattributable.
- What Notion did: It disconnected from Fireworks on November 3, deleted its stored data, disabled Insights and revoked API keys found in affected messages.
- What users should do: Treat pasted credentials as exposed and rotate any passwords or API keys entered into Notion AI during the incident window.
How the attack unfolded
According to Fireworks, a third-party cloud provider that hosted its research and development machines suffered a security incident on October 23. The following day, an unauthorized party used that foothold to reach Fireworks development systems and run a workload that expanded the scope of the intrusion. The stolen material included resource metadata, billing information and, for a limited set of accounts, parts of datasets and incomplete model weights. Fireworks says it does not store payment card numbers.
The timeline between the two companies moved quickly. On November 2, Fireworks alerted Notion that a small dataset had been accessed; initial analysis suggested it was synthetic testing data. By the morning of November 3, Notion had disconnected its systems from Fireworks and halted all communication between the two. On November 4, it deleted all of its data stored in the Fireworks system. On November 6, Fireworks warned that customer data may have been accessed, and on November 8 it confirmed the final impacted dataset — which included real Notion AI chat transcripts. Notion began contacting affected customers on November 9 and, on November 11, revoked Notion API keys discovered inside affected messages.
What the exposed transcripts contain
Notion used Fireworks for two purposes: running classification jobs that power Insights, a feature that shows administrators how AI is used across their workspace, and serving open-weight models inside its product. The leaked records are transcripts of chats sent to Fireworks for Insights processing.
For the vast majority of impacted workspaces, Notion describes the transcripts as “unattributable” — not labeled with who wrote them or which workspace they came from — and they did not include tool call results. Beyond the text of the conversation itself, there is no information tying a chat back to a workspace, user or company. That text, however, is exactly what users typed. Anyone who pasted internal data, passwords or API keys into the assistant during the incident window should assume that material is now in the hands of attackers.
“Any input to or output from the model that was written to the chat is included in that transcript,” Notion stated in its disclosure.
Notion has disabled the Insights feature while its investigation continues and no longer serves open-weight models through Fireworks. Owners of affected workspaces can review the data through the security incident review section of Notion’s web interface and share a link allowing members to download their own transcripts. Customers who have not been contacted have not been identified as affected and, for now, need take no action.
A growing pattern of AI supply-chain risk
Fireworks attributes the intrusion to a financially motivated criminal group focused on selling unauthorized access to large language models — a scheme known as LLMjacking, in which buyers burn through AI capacity without paying for it. The company has brought in Palo Alto Networks Unit 42 to assist the investigation and says it found no impact on its inference services, which by default do not retain data. Notion maintains that Fireworks had contractually committed not to retain its data; the advisory does not explain why the transcripts were stored.
The incident is the second breach affecting Fireworks in as many months, following an earlier intrusion in October that exposed stored secrets such as API keys. Fireworks, which is backed by Nvidia and counts more than 10,000 customers, says its investigation may yet reveal more about the attack’s scope.
The broader lesson is structural. Notion was not hacked directly; a vendor of a vendor was, and its users’ conversations still ended up exposed. Every layer added to an AI stack — model platform, cloud host, subprocessor — becomes another door, and the customer has no visibility into how many hands their prompts pass through. Notion’s response was fast and decisive, but speed cannot substitute for architecture: as long as AI products are assembled from third-party services, data-retention guarantees and vendor auditing will matter as much as model quality.