🔍 Read the full analysis: Notion Explains AI Chat Transcript Exposure After Fireworks Breach on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Notion says a dataset accessed in the Fireworks AI breach contained Notion AI chat transcripts from fewer than 1% of its workspaces. The company says the data had been retained by Fireworks despite a contractual zero-data-retention commitment, and it revoked exposed Notion API keys found in affected user messages on November 11.
Notion says a dataset accessed by attackers in the Fireworks AI breach contained Notion AI chat transcripts associated with fewer than 1% of Notion workspaces. The company says Fireworks had contractually committed to zero data retention but that its investigation found data had been retained; on November 11, Notion revoked exposed Notion API keys found in affected user messages.
Notion’s updated notice says the exposed dataset included transcripts used for its Insights feature, which gives workspace administrators information about how teams use AI. Notion says the transcripts were unattributable for most affected workspaces: they were not labeled with the author or workspace and did not include tool-call results. But a transcript can still contain what a user typed into Notion AI and what the model returned, and Notion advises affected customers to examine the data for sensitive content.
The company identifies two uses of Fireworks in its products: classification jobs for Insights and inference for open-weight models. Notion says the transcripts in the accessed dataset came from the Insights work. It says AI Meeting Notes—including audio, transcripts and summaries—were not affected unless material from them was used as input in a Notion AI chat transcript. Notion says no other features were affected.
Notion says it has contacted affected workspace owners and recommends treating the data as exposed. It advises them to review the information under its Security incident review guidance and rotate passwords, API keys or other credentials pasted into Notion AI during the incident. The company also says it revoked exposed Notion API keys found in affected user messages on November 11.
Notion AI transcript exposure after Fireworks breach
Notion says attackers accessed AI chat transcripts retained by Fireworks despite a contractual zero-retention commitment. Affected customers should review the chats and protect any credentials they may contain.
What was in the dataset
The accessed transcripts came from Notion’s Insights feature, which helps workspace administrators understand AI use.
Chats and model replies
A transcript may contain what a user typed into Notion AI and what the model returned, including sensitive information.
Usually unattributed
Most affected transcripts were not labeled with an author or workspace and did not include tool-call results.
Which features were involved
Notion says the dataset came from Insights classification work sent to Fireworks for analysis.
| Product data | Notion’s account |
|---|---|
| Insights chat transcripts | Included in accessed dataset |
| AI Meeting Notes | Not affected unless used as chat input |
| Other features | Not affected |
What customers should do
Notion has contacted affected workspace owners and recommends treating the data as exposed.
Use Notion’s incident review guidance to check inputs and outputs for sensitive content.
Change passwords, API keys, or other credentials that may have been entered into Notion AI.
What remains unclear
The public accounts leave important details about retention and scope unresolved.
- Notion has not provided a precise count of affected workspaces or people.
- The statements do not explain which Fireworks system retained the data or how long it was kept.
- Whether comparable retention affected other Fireworks customers is unknown.
Why Chat Content Raises Exposure Risks
The disclosure matters because chat transcripts may contain more than routine prompts. Users can paste customer details, contract information or credentials into an AI conversation, and Notion says the specific inputs and outputs in affected transcripts may include sensitive data. The company has not said that every transcript contained such information; its guidance is to inspect the affected material rather than assume it was harmless.
The incident also draws attention to the limits of zero data retention (ZDR) assurances. Notion says its ZDR commitments for live requests to model vendors do not cover features that require retained data, including chat history and Insights. For Insights, Notion says it sent stored AI requests and responses to Fireworks for analysis under a separate contractual zero-retention commitment. The reported retention shows that a contractual promise alone did not prevent data from being kept in this case.
For organizations using AI features, the practical issue is whether sensitive information was entered into an affected workflow and what steps are needed to protect it. Notion’s advice to rotate credentials is a specific response to possible credentials in the messages, not a statement that every affected workspace had credentials exposed.
Products Worth Considering
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Twilight Blue
Logitech MX Mechanical Wireless Illuminated Keyboard, Clicky Switches
DJI Osmo Pocket 3 Vlogging Camera with 1-Inch CMOS Sensor and 4K/120fps Video
As an affiliate, we earn on qualifying purchases.
How Notion and Fireworks Were Connected
Notion’s notice describes Fireworks as a provider used for both Insights classification and inference for open-weight models. The data at issue came from the first use, according to Notion. The company says Fireworks notified it on November 2 that a small set of data had been accessed by malicious actors; Notion initially understood the material to be synthetic testing data.
Notion says it disconnected its systems from Fireworks on November 3, deleted data held in the Fireworks system, stopped communications between the services and halted training runs. It later updated its notice on November 10 and 11 with information about the dataset and the chat transcripts. The source material says Fireworks’ own bulletin was still marked last updated November 9 and described datasets as among the data accessed for certain customers. Fireworks also said it had not detected an impact to Inference, Training SDK and Nexus, which it described as zero-data-retention by default.
The two companies’ published statements do not identify the Fireworks system that retained Notion’s data or explain how that retention occurred. They also do not establish whether the same issue affected other Fireworks customers. Those questions remain separate from Notion’s account of which of its own product data was involved.
“Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.”
— Notion, in its security notice
What the Breach Notice Leaves Open
Notion has not specified which Fireworks system retained the data, how long it was retained or how many people were affected. The company’s estimate is fewer than 1% of workspaces, but it has not provided a precise workspace or user count in the supplied notice.
The public accounts also do not explain why data was retained despite Fireworks’ contractual commitment, or whether the relevant system was covered by the ZDR-by-default services Fireworks discussed in its bulletin. Notion’s account concerns its own use of Fireworks; Fireworks’ statement about certain services does not resolve what happened to Notion’s Insights data. It is also unclear whether other Fireworks customers experienced comparable retention or exposure.
Notion says that if neither a user nor their workspace owner has received a notice, it has not identified that workspace as affected. That guidance reflects the company’s current identification, not a broader finding that no other data was involved.
Vendor Audit and Customer Reviews
Notion says it is auditing critical vendors, including inference providers and data processors, to check their data-minimization practices and zero-retention policies. The company has not provided a completion date or described further changes to its vendor controls. Its next public updates may clarify the scope of the audit and how it will verify retention commitments.
Affected workspace owners should follow Notion’s incident-review guidance, examine relevant chat inputs and outputs, and rotate any credentials that may have been pasted into those chats. Notion has not announced a separate deadline for those steps. Further detail from Notion or Fireworks will be needed to establish how the data was retained, the full number of people affected and whether the issue extended to other customers.
Key Questions
What Notion data was exposed?
Notion says the dataset accessed in the Fireworks breach included Notion AI chat transcripts used for Insights. It says most affected transcripts were unattributable to a particular user or workspace, but could still contain the text users entered and the model’s responses.
How many Notion workspaces were affected?
Notion says fewer than 1% of workspaces were affected. It has not published a precise count of workspaces or people in the information provided.
Were AI Meeting Notes exposed?
Notion says AI Meeting Notes, including audio, transcripts and summaries, were not affected unless that material was used as input in a Notion AI chat transcript. It says no other Notion features were affected.
What should affected users do?
Notion advises affected workspace owners to treat the data as exposed, review it under the company’s Security incident review guidance, and rotate passwords, API keys or other credentials pasted into Notion AI during the incident.
Did Fireworks’ zero-retention commitment prevent data storage?
Notion says Fireworks had made a contractual zero-data-retention commitment for its use of the platform, but Notion’s investigation found that data had been retained. The companies have not publicly explained which system retained it or why.
Source: ThorstenMeyerAI.com
