Notion says a security incident at its AI vendor, Fireworks AI, exposed Notion AI chat transcripts. In its security advisory, Notion says the incident affects "<1% of Notion workspaces." It says it is still investigating.

What was exposed

Notion says Fireworks gave it a dataset on Nov. 8 and that the dataset "included Notion AI chat transcripts used for the Insights feature." Notion says no other Notion features were affected.

Notion says that for most affected workspaces the chats are "unattributable." It explains that they were not labeled with who wrote them or which workspace they came from, and did not contain tool call results.

The timeline Notion gives

  • Nov. 2: Fireworks said a small set of data was accessed by malicious actors. Notion says that set held Notion AI synthetic testing data, not customer data.
  • Nov. 3: Notion says it disconnected from Fireworks and deleted all data in the Fireworks system.
  • Nov. 6: Fireworks said malicious actors may have accessed potential customer data.
  • Nov. 8: Fireworks confirmed the final impacted dataset.
  • Nov. 9: Notion contacted affected customers.

Notion also says that on Nov. 11 it revoked exposed Notion API keys found in affected user messages.

What to do

Notion says affected customers can review the data in their workspace, with instructions sent by email. In its help-center notice, it says workspace owners find it under the sidebar, the question-mark menu, then Security incident review. That page says to use a desktop browser.

If you were not contacted, Notion says it has not identified your workspace as affected and no action is needed now.

Notion recommends treating the data as exposed. If anyone pasted passwords, API keys or other credentials into Notion AI during the incident window, it says to rotate them. For the steps, see our story on rotating secrets after the Railway breach.

What Fireworks says

Fireworks has a separate security bulletin, last updated Nov. 9. It describes a third-party cloud provider incident on Oct. 23 and unauthorized access to development machines on Oct. 24. It says a limited set of accounts had secrets, datasets and incomplete model weights affected. It lists billing information and resource metadata, and says it does not store payment card numbers.

The bulletin does not mention Notion and does not name any customers. We cannot say from it alone that it describes the same events as Notion's advisory.

What isn't announced

  • The number of affected workspaces or people, beyond the share Notion gives.
  • The dates the exposed chats were created.
  • Whether Fireworks confirms the Notion link.
  • Whether any regulator has been notified.

What we checked

We read Notion's advisory and help-center notice and Fireworks' bulletin on the morning of Nov. 12 ET. Every claim above comes from them. We did not test anything or contact either company.

Related: Railway's environment variable breach, and the OpenCode console breach.