🔍 Read the full analysis: Notion Says Fireworks Breach Reached AI Chat Transcripts on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Notion says a dataset accessed in the Fireworks AI breach included stored Notion AI chat transcripts used for its Insights feature. Fewer than 1% of Notion workspaces have been identified as affected, and Notion says it revoked exposed API keys found in affected user messages on November 11. The companies have not explained where or for how long the data was retained.
Notion says chat transcripts from its AI service were included in data accessed during the Fireworks AI breach, adding a new disclosure to its security notice on November 10 and 11. The company says the transcripts were tied to its Insights feature, that fewer than 1% of Notion workspaces have been identified as affected, and that data was retained by Fireworks despite a contractual commitment to zero data retention.
Notion says the dataset Fireworks provided to it on November 8 included Notion AI chat transcripts used for Insights, a feature that gives workspace administrators information about team AI use. Notion describes most affected transcripts as “unattributable”: they were not labeled with the author or workspace and did not include tool-call results. The company defines a transcript as any input to or output from a model that was written to the chat, so it may include sensitive details users entered or received.
Notion advises affected customers to review the exposed material as if it were disclosed publicly and to check it for sensitive information. It also said on November 11 that it revoked exposed Notion API keys found in affected user messages. The company recommends rotating passwords, API keys and other credentials that may have been pasted into Notion AI during the incident.
Notion says AI Meeting Notes were not affected, unless audio, a transcript or a summary was later entered as input in a Notion AI chat. It says no other Notion features were affected. Notion’s notice says it has identified fewer than 1% of workspaces as affected; according to the source material, customers who have not received a notice from Notion have not had their workspace identified as affected.
Notion Says Fireworks Breach Reached AI Chat Transcripts
Notion says data accessed in the Fireworks AI breach included stored chat transcripts used for Insights. Affected customers should review the material and rotate credentials shared in chats.
What the dataset included
Notion says the transcripts came from Insights, which analyzes team AI use.
Chat inputs and outputs
Messages written to the chat may contain sensitive details users entered or received.
Most lacked labels
Notion says most transcripts did not identify the author or workspace and lacked tool-call results.
How the data was handled
Notion says it sent stored requests and responses to Fireworks for Insights analysis under a zero-retention commitment.
On November 2, Notion says it was told a small amount of data had been accessed.
On November 3, it says it disconnected from Fireworks, deleted data there and halted training runs.
Notion updated its notice on November 10 and 11 to describe the affected chat transcripts.
What customers should do
Notion advises contacted customers to treat affected material as publicly disclosed.
What remains unclear
The public statements leave key details about retention and scope unanswered.
- Which Fireworks system retained the data
- How long it was stored
- How many users or transcripts were affected
- Fewer than 1% of workspaces identified as affected
- It is auditing critical vendors for data-minimization practices
- No other Notion features were affected
The Risk in Stored AI Chats
The disclosure matters because chat transcripts can contain information users submit for routine work, including customer names, contract details or credentials. Notion says the transcripts may include model inputs and outputs, and recommends a close review of affected data because individual messages could hold sensitive information. The claim that most transcripts were not labeled with a person or workspace may limit direct attribution, but it does not mean the content itself was non-sensitive.
The incident also highlights a distinction between an AI provider’s handling of live requests and the storage required for product features. Notion says its zero-retention protections for live model requests do not cover stored chat history or Insights data. For Insights, Notion says it sent stored requests and responses to Fireworks for analysis under a contractual zero-retention commitment. It now says that data was retained anyway. That discrepancy raises questions for customers about how vendor commitments are monitored and how stored AI data is handled.
Products Worth Considering
Dell UltraSharp U2424H 24-Inch FHD Monitor
Apple MacBook Air 13-inch with M5 Chip, 16GB Memory, 512GB SSD, Silver
FlexiSpot E6 Electric Standing Desk, 55 × 28 in, Bamboo Top, White Frame
As an affiliate, we earn on qualifying purchases.
How Insights Sent Data to Fireworks
Notion says it used Fireworks for two purposes: classification jobs for Insights and as a general inference provider for open-weight models inside its product. The transcripts in the newly described dataset came from the Insights work, according to Notion. Its FAQ says zero data retention applies to API requests sent to third-party model providers to generate Notion AI responses, but not to use cases such as chat history and Insights that require data to be retained.
Notion’s published incident timeline says Fireworks notified it on November 2 that a small amount of data had been accessed by malicious actors. Notion initially understood that data to be synthetic testing material. On November 3, it says, it disconnected its systems from Fireworks, deleted data in the Fireworks system, stopped communications with the provider and halted training runs. Fireworks’ own bulletin was last updated November 9, according to the source material, while Notion subsequently updated its advisory and help page.
Fireworks has said it did not detect an impact to Inference, Training SDK and Nexus, which it describes as zero-data-retention by default. Its bulletin also lists datasets among data accessed for certain customers. The published statements do not identify which Fireworks system retained Notion’s data or explain how that squares with the companies’ descriptions of zero-retention protections.
““Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.””
— Notion
Open Questions About Retention
The public notices do not say which Fireworks system retained the data, how long it remained there, or how many individual users were affected. Notion has provided a workspace-level estimate of fewer than 1%, but the source material does not give a total count of people or transcripts. It is also unclear whether other Fireworks customers experienced similar data retention.
The two companies’ statements leave a further technical question unanswered: Fireworks says several products are zero-retention by default, while Notion says data from the endpoints it used was retained. Neither company has publicly connected those statements by identifying the relevant endpoint or storage system. The available information does not establish how or why the retention occurred, and it would be premature to infer a specific cause.
Notion says most affected transcripts could not be attributed to a person or workspace based on their labels. The notice does not explain whether other information in the dataset could allow attribution, or what types of sensitive content were actually present. No complete inventory of exposed messages has been provided in the source material.
Vendor Audit and Customer Review
Notion says it is auditing critical vendors, including inference providers and data processors, to check whether they follow data-minimization practices, including zero-retention policies. The company has not given a completion date or described what changes the audit may produce. Further updates to its security advisory could clarify the retained data’s location, retention period and scope.
For customers who have been contacted, Notion’s guidance is to review the affected data and rotate any passwords, API keys or other credentials entered in Notion AI during the incident. Customers should distinguish that advice from a finding that every affected transcript contained credentials: Notion’s notice says the specific contents vary and may include sensitive information. The extent of any additional investigation or notification from Fireworks remains unknown.
Key Questions
What information does Notion say was exposed?
Notion says a dataset accessed in the Fireworks breach included Notion AI chat transcripts used for Insights. It defines a transcript as model input or output written to the chat. Notion says most affected transcripts were not labeled with the author or workspace.
How many Notion workspaces are affected?
Notion says it has identified fewer than 1% of workspaces as affected. The source material does not provide a number of affected individuals or transcripts.
Were AI Meeting Notes exposed?
Notion says AI Meeting Notes, including audio, transcripts and summaries, were not affected unless that material was used as input in a Notion AI chat. It says no other Notion features were affected.
What should an affected customer do?
Notion advises affected customers to treat the data as exposed, review it for sensitive information, and rotate passwords, API keys or other credentials pasted into Notion AI during the incident. Notion says it revoked exposed API keys found in affected user messages on November 11.
Why did Fireworks retain data if it had a zero-retention commitment?
Notion says Fireworks had made a contractual zero-retention commitment but that its investigation found data had been retained from the endpoints Notion used. The companies have not publicly explained which system retained the data or how the retention happened.
Source: ThorstenMeyerAI.com
