🔍 Read the full analysis: AI Chat Transcripts Were Exposed In Fireworks Breach, Notion Says on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Notion says data accessed in the Fireworks AI breach included stored Notion AI chat transcripts used for its Insights feature. It says fewer than 1% of Notion workspaces are affected and that it revoked exposed Notion API keys found in affected messages on November 11. How long Fireworks retained the data and which of its systems stored it remain unclear.
Notion says attackers accessed a dataset containing Notion AI chat transcripts in the Fireworks AI breach, widening the potential exposure beyond the synthetic testing data it first understood to be involved. The company says the transcripts were used for its Insights feature, fewer than 1% of Notion workspaces are affected, and it revoked exposed Notion API keys found in affected user messages on November 11.
In its updated advisory and Help Center notice, Notion said a dataset Fireworks provided on November 8 included stored requests and responses from Notion AI used for Insights, a feature that gives workspace administrators information about how teams use AI. Notion said the transcripts for most affected workspaces were “unattributable”: they were not labeled with the author or workspace and did not include tool-call results.
That does not mean the transcript contents were necessarily harmless or anonymous in practice. Notion defines a transcript as any input to or output from the model written in the chat, and advises affected users to review the data because it may contain sensitive information. On November 11, the company said it revoked exposed Notion API keys found in affected user messages. It advised affected users to treat the material as exposed and rotate passwords, API keys or other credentials pasted into Notion AI during the incident.
Notion says fewer than 1% of workspaces are affected. It says users whose workspace has been identified should have received notice; it has not identified a workspace as affected if neither the user nor workspace owner has heard from the company. Notion also said AI Meeting Notes were not affected unless their content was used as an input in a Notion AI chat transcript, and that no other Notion features were affected.
Notion AI Chats ExposedWhat the Fireworks breach means
Notion says attackers accessed stored AI chat transcripts used for its Insights feature. Affected users should review the data and rotate any credentials pasted into chats.
What the dataset contained
The accessed dataset included stored Notion AI requests and responses sent for Insights classification.
Chat transcripts
Inputs and outputs could contain sensitive business details or credentials pasted into a chat.
Often unlabeled
Most affected transcripts were not labeled with an author or workspace. Their contents may still identify people or organizations.
What users should do
Notion advises affected workspaces to treat the material as exposed.
Check relevant Notion AI chats for sensitive information.
Change passwords, API keys, or other credentials pasted into chats during the incident.
What remains unclear
The published notices leave key details about storage and scope unanswered.
Stored Chats Put Credentials at Risk
The disclosure matters because the exposed material came from stored AI requests and responses, not just information submitted during a live model request. A chat can include customer names, business details, contract language or credentials that a user pasted into it. Notion’s description of transcripts means those contents may have been part of the accessed dataset, even when the record did not identify the person or workspace.
For affected organizations, the practical concern is not limited to whether a transcript can be linked to a named user. A password or API key included in the text may still be usable, and sensitive business information may be identifiable from its contents. Notion’s instruction to review affected data and rotate credentials reflects those risks. The company’s reported scope is limited to fewer than 1% of workspaces, but it has not published a total number of affected people or records.
The incident also puts attention on how AI services handle data after a request is answered. Notion said Fireworks had made a contractual zero-data-retention commitment for its use of the platform, yet data was retained from the endpoints Notion used. The disclosure leaves an important distinction for customers: a provider’s retention terms, the technical path used for a particular feature and the data stored to deliver that feature may not be the same thing.
Products Worth Considering
LG UltraGear 27G810A-B 27-Inch 4K UHD IPS Gaming Monitor
LG UltraGear 32-Inch QHD 180Hz Curved Gaming Monitor
Ledger Nano Gen5 Crypto Wallet, Black
As an affiliate, we earn on qualifying purchases.
How Insights Used Fireworks Data
Notion said it used Fireworks for two purposes: classification jobs for Insights and as a general inference provider for open-weight models in its product. The company says the exposed dataset came from the Insights classification work, rather than the general inference service. Notion describes Insights as a feature that relies on stored Notion AI requests and responses to show workspace administrators how teams use AI.
Notion’s notice says its zero-retention commitments for live requests to third-party model vendors cover API requests made to generate Notion AI responses. It says those commitments are not intended to cover data retained for features such as chat history and Insights. For Insights, Notion sent stored requests and responses to Fireworks for analysis, and says Fireworks had contractually promised zero data retention for Notion’s use of its platform.
Fireworks’ own update, last marked November 9, said it had not detected an impact to Inference, Training SDK and Nexus, which it described as zero-retention by default. Its notice also listed datasets among information accessed for certain customers. The published statements do not identify which Fireworks system retained Notion’s data. Notion said it disconnected its systems from Fireworks on November 3, deleted its data from the Fireworks system and stopped communications between the companies’ systems.
“Unfortunately, during our investigation we learned that data was retained from the Fireworks endpoints that we used.”
— Notion
Retention System and Scope Still Unknown
Notion and Fireworks have not publicly identified which Fireworks system stored the transcripts, why the data was retained despite the contractual commitment, or how long it remained there. The available statements also do not explain how Notion’s data-retention account fits with Fireworks’ description of its named services as zero-retention by default.
Notion has not disclosed the number of affected people, the volume of transcripts or a detailed breakdown of the types of sensitive information involved. Its estimate is fewer than 1% of workspaces, not a count of users or records. It is also unclear from the notices whether other Fireworks customers’ data was retained in a similar way. No evidence in the available statements establishes that the exposed transcripts were accessed or used beyond their inclusion in the dataset reached by attackers.
Notion Audits Its AI Vendors
Notion said it is auditing critical vendors, including inference providers and data processors, to check their data-minimization practices and compliance with zero-retention policies. The company has disconnected from Fireworks for this use, according to its timeline, and says it deleted its data from Fireworks’ system. A fuller account of the system involved, retention period and investigation findings has not yet been provided.
Users who receive an affected-workspace notice should follow Notion’s guidance: review relevant data as if it had been exposed and rotate any passwords, API keys or other credentials pasted into Notion AI during the incident. Notion’s notices do not give a date for a final investigation report or say when its vendor audit will be complete.
Key Questions
What Notion data was exposed in the Fireworks breach?
Notion says the accessed dataset included Notion AI chat transcripts used for its Insights feature, including stored model inputs and outputs. The company says most affected transcripts were not labeled with a user or workspace, but their contents may still include sensitive information.
How many Notion workspaces are affected?
Notion puts the scope at fewer than 1% of workspaces. It has not published a precise workspace, user or transcript count. The company says affected users or workspace owners have been notified.
Should affected users change passwords or API keys?
Notion advises affected users to review the relevant data as if it were exposed and rotate passwords, API keys and other credentials pasted into Notion AI during the incident. On November 11, it said it revoked exposed Notion API keys found in affected user messages.
Were Notion AI Meeting Notes affected?
Notion says AI Meeting Notes, including audio, transcripts and summaries, were not affected unless they were used as input in a Notion AI chat transcript. It also said no other Notion features were affected.
What is still unknown about the incident?
The companies have not said which Fireworks system retained Notion’s data, how long it was stored or how many people and records were involved. It is also unclear whether other Fireworks customers had a similar retention issue.
Source: ThorstenMeyerAI.com
